November 2005 - Freeradius-Users - lists.freeradius.org

Re: Problem with EAP/TLS and XP SP2
by mahesh luhar 10 Nov '05

10 Nov '05

----- Original Message ----- From: "Hal Pomeranz" <hal(a)deer-run.com> To: freeradius-users(a)lists.freeradius.org Subject: Problem with EAP/TLS and XP SP2 Date: Wed, 2 Nov 2005 21:22:55 -0800 > > Radius Server: Freeradius 1.0.5 on Solaris 8 (Sparc) > Client: Windows XP (SP2), Intel PRO/Wireless 2915 (a/b/g) > Access Point: DLink DI-784 > > I'm having trouble getting my laptop (running Windows XP SP2) to > authenticate to my access point using EAP/TLS. XP shows the wireless > interface hung forever in "Attempting to authenticate" state. I've > been beating my head against this all day without success, although I > think I'm close and just missing something stupid and obvious. > > In the debugging log from "radiusd -X" below, I can see my laptop > communicating with the radius server. I'm definitely seeing the > correct username ("HalPomeranz") from the certificate I installed > on the laptop. The radius server is finding the username entry > in my "users" file. The only thing that looks like an error is > the lines that read: > > rlm_eap_tls: >>> TLS 1.0 Handshake [length 005e], CertificateRequest > TLS_accept: SSLv3 write certificate request A > TLS_accept: SSLv3 flush data > TLS_accept:error in SSLv3 read client certificate A > > I Googled a bit for this error message and turned up some mailing list > traffic describing similar problems, but no solutions. Perhaps this > is a red herring, however. > > Note that I am successfully using this same radius server to > authenticate some older clients which use LEAP to connect via a > different access point, so I'm thinking my radius config is basically > sound. > > Does anybody have any suggestions for how to resolve my problem? > Anybody seen anything like this before? Thanks in advance... > > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > Hal Pomeranz, Founder/CEO Deer Run Associates hal(a)deer-run.com > Network Connectivity and Security, Systems Management, Training > -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- > > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /var/freeradius/etc/raddb/proxy.conf > Config: including file: /var/freeradius/etc/raddb/clients.conf > Config: including file: /var/freeradius/etc/raddb/snmp.conf > Config: including file: /var/freeradius/etc/raddb/eap.conf > Config: including file: /var/freeradius/etc/raddb/sql.conf > main: prefix = "/var/freeradius" > main: localstatedir = "/var/freeradius/var" > main: logdir = "/var/freeradius/var/log/radius" > main: libdir = "/var/freeradius/lib" > main: radacctdir = "/var/freeradius/var/log/radius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 1812 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/var/freeradius/var/log/radius/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/var/freeradius/var/run/radiusd/radiusd.pid" > main: user = "radiusd" > main: group = "radiusd" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/var/freeradius/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = yes > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > Using deprecated naslist file. Support for this will go away soon. > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /var/freeradius/lib > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "crypt" > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > mschap: ntlm_auth = "(null)" > Module: Instantiated mschap (mschap) > Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "(null)" > unix: group = "(null)" > unix: radwtmp = "/var/freeradius/var/log/radius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded eap > eap: default_eap_type = "tls" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/var/freeradius/etc/raddb/certs/server_key.pem" > tls: certificate_file = "/var/freeradius/etc/raddb/certs/server_cert.pem" > tls: CA_file = "/var/freeradius/etc/raddb/certs/cacert.pem" > tls: private_key_password = "" > tls: dh_file = "/var/freeradius/etc/raddb/certs/dh" > tls: random_file = "/var/freeradius/etc/raddb/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = yes > tls: check_cert_cn = "%{User-Name}" > rlm_eap: Loaded and initialized type tls > peap: default_eap_type = "mschapv2" > peap: copy_request_to_tunnel = no > peap: use_tunneled_reply = no > peap: proxy_tunneled_request_as_eap = yes > rlm_eap: Loaded and initialized type peap > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/var/freeradius/etc/raddb/huntgroups" > preprocess: hints = "/var/freeradius/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/var/freeradius/etc/raddb/users" > files: acctusersfile = "/var/freeradius/etc/raddb/acct_users" > files: preproxy_usersfile = "/var/freeradius/etc/raddb/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = > "/var/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/var/freeradius/var/log/radius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > rad_recv: Access-Request packet from host 192.168.100.4:1435, > id=199, length=139 > User-Name = "HalPomeranz" > NAS-IP-Address = 192.168.100.4 > NAS-Port = 0 > Called-Station-Id = "00-0D-88-C5-20-71" > Calling-Station-Id = "00-15-00-0E-F4-F5" > NAS-Identifier = "DI-784" > Framed-MTU = 1380 > NAS-Port-Type = Wireless-802.11 > EAP-Message = 0x020100100148616c506f6d6572616e7a > Message-Authenticator = 0xe476642b4d621276fdcfa07fc848c5d6 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "HalPomeranz", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: EAP packet type response id 1 length 16 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 0 > users: Matched entry HalPomeranz at line 101 > modcall[authorize]: module "files" returns ok for request 0 > modcall: group authorize returns updated for request 0 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > rlm_eap: EAP Identity > rlm_eap: processing type tls > rlm_eap_tls: Requiring client certificate > rlm_eap_tls: Initiate > rlm_eap_tls: Start returned 1 > modcall[authenticate]: module "eap" returns handled for request 0 > modcall: group authenticate returns handled for request 0 > Sending Access-Challenge of id 199 to 192.168.100.4:1435 > EAP-Message = 0x010200060d20 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xf5332abd7af77b9911176ec9aa69e0e8 > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 6 seconds... > rad_recv: Access-Request packet from host 192.168.100.4:1435, > id=200, length=221 > User-Name = "HalPomeranz" > NAS-IP-Address = 192.168.100.4 > NAS-Port = 0 > Called-Station-Id = "00-0D-88-C5-20-71" > Calling-Station-Id = "00-15-00-0E-F4-F5" > NAS-Identifier = "DI-784" > Framed-MTU = 1380 > NAS-Port-Type = Wireless-802.11 > EAP-Message = > 0x020200500d800000004616030100410100003d030143696dabf9029fc190693ca4dc70364a394a56ff89289a020122f2e7346c770500001600040005000a000900640062000300060013001200630100 > State = 0xf5332abd7af77b9911176ec9aa69e0e8 > Message-Authenticator = 0x438ea47659b46e7e17bb9a54f66f02be > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 1 > modcall[authorize]: module "preprocess" returns ok for request 1 > modcall[authorize]: module "chap" returns noop for request 1 > modcall[authorize]: module "mschap" returns noop for request 1 > rlm_realm: No '@' in User-Name = "HalPomeranz", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 1 > rlm_eap: EAP packet type response id 2 length 80 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 1 > users: Matched entry HalPomeranz at line 101 > modcall[authorize]: module "files" returns ok for request 1 > modcall: group authorize returns updated for request 1 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 1 > rlm_eap: Request found, released from the list > rlm_eap: EAP/tls > rlm_eap: processing type tls > rlm_eap_tls: Authenticate > rlm_eap_tls: processing TLS > rlm_eap_tls: Length Included > eaptls_verify returned 11 > (other): before/accept initialization > TLS_accept: before/accept initialization > rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello > TLS_accept: SSLv3 read client hello A > rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello > TLS_accept: SSLv3 write server hello A > rlm_eap_tls: >>> TLS 1.0 Handshake [length 0510], Certificate > TLS_accept: SSLv3 write certificate A > rlm_eap_tls: >>> TLS 1.0 Handshake [length 005e], CertificateRequest > TLS_accept: SSLv3 write certificate request A > TLS_accept: SSLv3 flush data > TLS_accept:error in SSLv3 read client certificate A > In SSL Handshake Phase > In SSL Accept mode > eaptls_process returned 13 > modcall[authenticate]: module "eap" returns handled for request 1 > modcall: group authenticate returns handled for request 1 > Sending Access-Challenge of id 200 to 192.168.100.4:1435 > EAP-Message = > 0x0103040a0dc0000005c7160301004a02000046030143696da6a2b012e765aa3f113c4c1ed6e28c40f51807859cd4394962388ae6e0202f9cf584c484b68b3aa0eb66ee1d1edec787b87407a2bf043891da3dc798f42b00040016030105100b00050c00050900024730820243308201aca003020102020101300d06092a864886f70d0101040500304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f636961746573301e170d3035313130323139323533385a170d3036313130323139323533385a3069310b300906 > EAP-Message = > 0x0355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f636961746573311a301806035504031311646565722e646565722d72756e2e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100c0511b635bded2881c4db827a89c521fbcc5a06b435b4ad56cd1b9b8ad0e78815ef2bd5d1e60e7a4c7f6b1a154cde960cf5de365fdd2fa462b3b90934d252245e87996b4031326e118dc68f9c9f6e3efb08958ba388f7677c47ecbf35514a74f27926b6a39d7f452c9caa2fb9d98fd3bdde64c4aa8f1b81228f502d1 > EAP-Message = > 0x117dcd5f0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010104050003818100243b1d366876ce82374e51d6e84e0a7e93a70558baad71a2a43ddc3602bc87df8c8d96fc2e903e1b68ae3bfdd5e1e8e1764d7d636d7bcdd0aa4a2f33598115ad1b6d90d43596654f4f956f26ad6cfc6d47330bc0d2a57e8e1998b9fc6da570c117a643bb699091f80f5aff0c44f6bb875ef27e0d79fbfda8ca01763debfff8960002bc308202b830820221a003020102020100300d06092a864886f70d0101040500304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d0603 > EAP-Message = > 0x5504071306457567656e65311c301a060355040a1313446565722052756e204173736f636961746573301e170d3035313130323139313931355a170d3036313130323139313931355a304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f63696174657330819f300d06092a864886f70d010101050003818d0030818902818100c16d27eab105d0e179e6a58207dd1b7d0c1a5a64f761506275abebf495254f4e242f9d13926e56bfe0bb8d9130afca9287746c12c5eed4f0ae5233ecc412bba6693cf9fad4e1db0f > EAP-Message = 0x4f4b39c0f47ed5293975a9448d479ca38fbddeef68e1 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0xf608c3c340e7dcd273e77d1ca5afd315 > Finished request 1 > Going to the next request > Waking up in 6 seconds... > rad_recv: Access-Request packet from host 192.168.100.4:1435, > id=201, length=147 > User-Name = "HalPomeranz" > NAS-IP-Address = 192.168.100.4 > NAS-Port = 0 > Called-Station-Id = "00-0D-88-C5-20-71" > Calling-Station-Id = "00-15-00-0E-F4-F5" > NAS-Identifier = "DI-784" > Framed-MTU = 1380 > NAS-Port-Type = Wireless-802.11 > EAP-Message = 0x020300060d00 > State = 0xf608c3c340e7dcd273e77d1ca5afd315 > Message-Authenticator = 0x399bf08221ad337dec5353e34d1f3f9e > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 2 > modcall[authorize]: module "preprocess" returns ok for request 2 > modcall[authorize]: module "chap" returns noop for request 2 > modcall[authorize]: module "mschap" returns noop for request 2 > rlm_realm: No '@' in User-Name = "HalPomeranz", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 2 > rlm_eap: EAP packet type response id 3 length 6 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 2 > users: Matched entry HalPomeranz at line 101 > modcall[authorize]: module "files" returns ok for request 2 > modcall: group authorize returns updated for request 2 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 2 > rlm_eap: Request found, released from the list > rlm_eap: EAP/tls > rlm_eap: processing type tls > rlm_eap_tls: Authenticate > rlm_eap_tls: processing TLS > rlm_eap_tls: Received EAP-TLS ACK message > rlm_eap_tls: ack handshake fragment handler > eaptls_verify returned 1 > eaptls_process returned 13 > modcall[authenticate]: module "eap" returns handled for request 2 > modcall: group authenticate returns handled for request 2 > Sending Access-Challenge of id 201 to 192.168.100.4:1435 > EAP-Message = > 0x010401d10d80000005c709eeaeeb99893a248df35086a268947b61542d3988e761db738040976f08e84fd7830203010001a381a73081a4301d0603551d0e0416041400b41eff09bcce9ad9f1b04ba50419a7db44a7f030750603551d23046e306c801400b41eff09bcce9ad9f1b04ba50419a7db44a7f0a151a44f304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f636961746573820100300c0603551d13040530030101ff300d06092a864886f70d010104050003818100b8ddea1e6f5851b78cca0feab23bd8 > EAP-Message = > 0x9b7d268ab9250ccd7a7d720d6c2cf103477a6445773dca5be28fd44611b9e4a2a9a6331550fbad950e21fea1ff8e70a3d178c9d1ebf13b12cd80d6ce561be9699a922a722207d4950140bb0aeb3d8b3e22021a83c91948f1903b4eaedb66a1288837436871f1a57bda39f374a3fb8af28b160301005e0d0000560201020051004f304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f6369617465730e000000 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x86870d983715d15f6919bdba762433c2 > Finished request 2 > Going to the next request > --- Walking the entire request list --- > Waking up in 5 seconds... > rad_recv: Access-Request packet from host 192.168.100.4:1435, > id=202, length=147 > User-Name = "HalPomeranz" > NAS-IP-Address = 192.168.100.4 > NAS-Port = 0 > Called-Station-Id = "00-0D-88-C5-20-71" > Calling-Station-Id = "00-15-00-0E-F4-F5" > NAS-Identifier = "DI-784" > Framed-MTU = 1380 > NAS-Port-Type = Wireless-802.11 > EAP-Message = 0x020400060d00 > State = 0x86870d983715d15f6919bdba762433c2 > Message-Authenticator = 0xeda680bdf69e5dd588260e1c36169581 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 3 > modcall[authorize]: module "preprocess" returns ok for request 3 > modcall[authorize]: module "chap" returns noop for request 3 > modcall[authorize]: module "mschap" returns noop for request 3 > rlm_realm: No '@' in User-Name = "HalPomeranz", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 3 > rlm_eap: EAP packet type response id 4 length 6 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 3 > users: Matched entry HalPomeranz at line 101 > modcall[authorize]: module "files" returns ok for request 3 > modcall: group authorize returns updated for request 3 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 3 > rlm_eap: Request found, released from the list > rlm_eap: EAP/tls > rlm_eap: processing type tls > rlm_eap_tls: Authenticate > rlm_eap_tls: processing TLS > rlm_eap_tls: Received EAP-TLS ACK message > rlm_eap_tls: ack handshake fragment handler > eaptls_verify returned 1 > eaptls_process returned 13 > modcall[authenticate]: module "eap" returns handled for request 3 > modcall: group authenticate returns handled for request 3 > Sending Access-Challenge of id 202 to 192.168.100.4:1435 > EAP-Message = 0x0105000a0d8000000000 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x2b04eed7fe0be0ec28fbba826e52b47c > Finished request 3 > Going to the next request > --- Walking the entire request list --- > Waking up in 4 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 199 with timestamp 43696da6 > Cleaning up request 1 ID 200 with timestamp 43696da6 > Waking up in 1 seconds... > --- Walking the entire request list --- > Cleaning up request 2 ID 201 with timestamp 43696da7 > Waking up in 1 seconds... > --- Walking the entire request list --- > Cleaning up request 3 ID 202 with timestamp 43696da8 > Nothing to do. Sleeping until we see a request. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- _______________________________________________ Search for businesses by name, location, or phone number. -Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as…

1 0

RE: freeradius wont let realms based auth
by Andres Pazos 10 Nov '05

10 Nov '05

thanks alan for answering so fast. i think im misunderstanding something on the entire process. could u tell me if what i am doing is correct? i want to: radius packet if realm == wireless do sql query if real == dhcp do mysql query i have sql and mysql working with radiusd. could it be done by using acct-type or i should do other thing? thanks in advance!!! Andres Pazos -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org on behalf of Alan DeKok Sent: Thu 11/10/2005 7:42 PM To: FreeRadius users mailing list Subject: Re: freeradius wont let realms based auth "Andres Pazos" <andy(a)ferengi.com.ar> wrote: > i've red acct-type and tried to do the same. is that correct?, should i > use acct-type?, If you're sending authentication packets, acct-type isn't used at all. > auth: No authenticate method (Auth-Type) configuration found for the > request: Rejecting the user You didn't tell the server the users correct password. It has a password in the packet, but it has no idea if it's the *right* password. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

compile problem on solaris express nv23 x86
by Tariq Rashid 10 Nov '05

10 Nov '05

doing a configure ./configure --prefix=/opt/freeradius-snapshot-20051110 --with-openssl-includes=/usr/sfw/include/openssl --with-openssl-libraries=/usr/sfw/lib using the 20051110 snapshot - i still don't get a compile. havong said that this is much better than 1.0.2 and 1.0.5 any ideas? solaris express x86 nv23 DOES have the appropriate libraries and tools installed - openssl, gmake etc gmake gives: hmac.c: In function `lrad_hmac_md5': hmac.c:47: error: `lrad_MD5_CTX' undeclared (first use in this function) hmac.c:47: error: (Each undeclared identifier is reported only once hmac.c:47: error: for each function it appears in.) hmac.c:47: error: syntax error before "context" hmac.c:59: error: syntax error before "tctx" hmac.c:61: warning: implicit declaration of function `lrad_MD5Init' hmac.c:61: warning: nested extern declaration of `lrad_MD5Init' hmac.c:61: error: `tctx' undeclared (first use in this function) hmac.c:62: warning: implicit declaration of function `lrad_MD5Update' hmac.c:62: warning: nested extern declaration of `lrad_MD5Update' hmac.c:63: warning: implicit declaration of function `lrad_MD5Final' hmac.c:63: warning: nested extern declaration of `lrad_MD5Final' hmac.c:95: warning: nested extern declaration of `lrad_MD5Init' hmac.c:61: warning: redundant redeclaration of 'lrad_MD5Init' hmac.c:61: warning: previous implicit declaration of 'lrad_MD5Init' was here hmac.c:95: error: `context' undeclared (first use in this function) hmac.c:97: warning: nested extern declaration of `lrad_MD5Update' hmac.c:62: warning: redundant redeclaration of 'lrad_MD5Update' hmac.c:62: warning: previous implicit declaration of 'lrad_MD5Update' was here hmac.c:99: warning: nested extern declaration of `lrad_MD5Final' hmac.c:63: warning: redundant redeclaration of 'lrad_MD5Final' hmac.c:63: warning: previous implicit declaration of 'lrad_MD5Final' was here gmake[4]: *** [hmac.lo] Error 1 gmake[4]: Leaving directory `/home/tariq/freeradius/freeradius-snapshot-20051110/src/lib' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/home/tariq/freeradius/freeradius-snapshot-20051110/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/home/tariq/freeradius/freeradius-snapshot-20051110/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/home/tariq/freeradius/freeradius-snapshot-20051110' gmake: *** [all] Error 2

2 1

RE: VSA id's higer than 255
by Swaran S. Sethi 10 Nov '05

10 Nov '05

Thanks Alan. -Swaran -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, November 10, 2005 3:45 PM To: FreeRadius users mailing list Subject: Re: VSA id's higer than 255 "Swaran S. Sethi" <ssethi(a)kinetowireless.com> wrote: > I was writing to check if support for "VSA Id's higher than 255" has > been added in freeRadius 1.0.5. I will appreciate any feedback you guys > might have. It's not in 1.0.5, and I'm not sure it will be. It's in the CVS head, including Starent attributes, which are 16/16 bits. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: VSA id's higer than 255
by Swaran S. Sethi 10 Nov '05

10 Nov '05

I was writing to check if support for "VSA Id's higher than 255" has been added in freeRadius 1.0.5. I will appreciate any feedback you guys might have. Regards, Swaran Sethi -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Tuesday, August 02, 2005 2:09 PM To: FreeRadius users mailing list Subject: Re: VSA id's higer than 255 Michael Lecuyer <mjl(a)theorem.com> wrote: > The format for the long tag VSA is the same as the standard > Vendor-Specific attribute (8 bit tag, 8 bit length) but the > sub-attribute tag field has been expanded to 16 bits. The sub-attribute > length field remains 8 bits. That doesn't sound too bad. > All vendor specific attributes are coded using 16-bit attribute type in > network byte order and Lucent-Vendor-Id (4846) as Vendor-Id. That makes it easier. > I believe the support for long Vendor-Specific tags was discussed here > in the past with limited interest in support. It's about 40 lines of code to support. The weirdness that I recall was Nortel, which mixed normal VSA's, and USR-style VSA's in the same vendor space. > 192.168.1.1 ... VendorLongTags=Ascend > - indicating that Ascend VSA's use long tags and all other VSA's like > Cisco) would be short. Ascend / Lucent VSA's do not always use long tag > VSAs. If it's always that the Lucent attributes use 16-bit id's, it's OK. > This introduction of long tags is a real wart for every RADIUS server. > There are probably other ways to have avoided 16 bit tags. Naturally the > offender is too big to ignore and arbitrarily forced the issue. Remember > that in the past Ascend (pre-Lucent) grabbed unassigned RADIUS > attributes (from 119 to 255) without thinking there might be a problem > with that either. Yup. I'll add something to the CVS head. Grab a snapshot in a few days, and see if it works. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Sun SSH and pam_radius_auth
by JR Mayberry 10 Nov '05

10 Nov '05

Has anyone seen an issue with Sun SSH and pam_radius_auth where it sends a RADIUS Access-Request packet appearntly during ssh-connection method none? Nov 10 23:30:06 aaa01 sshd[8702]: [ID 800047 auth.debug] debug1: userauth-request for user red service ssh-connection method none Nov 10 23:30:06 aaa01 sshd[8702]: [ID 800047 auth.debug] debug1: attempt 0 failures 0 Nov 10 23:30:06 aaa01 sshd[8702]: [ID 800047 auth.debug] debug1: Starting up PAM with username "red" Nov 10 23:30:06 aaa01 sshd[8702]: [ID 730685 auth.debug] PAM[8702]: pam_start(sshd,red,b6930:cfdc8) - debug = 1 Nov 10 23:30:06 aaa01 sshd[8702]: [ID 434390 auth.debug] PAM[8702]: pam_set_item(cfdc8:service) Nov 10 23:30:06 aaa01 sshd[8702]: [ID 434390 auth.debug] PAM[8702]: pam_set_item(cfdc8:user) Nov 10 23:30:06 aaa01 sshd[8702]: [ID 434390 auth.debug] PAM[8702]: pam_set_item(cfdc8:conv) Nov 10 23:30:06 aaa01 sshd[8702]: [ID 434390 auth.debug] PAM[8702]: pam_set_item(cfdc8:tty) Nov 10 23:30:06 aaa01 sshd[8702]: [ID 800047 auth.debug] debug1: userauth_banner: sent Nov 10 23:30:06 aaa01 sshd[8702]: [ID 434390 auth.debug] PAM[8702]: pam_set_item(cfdc8:conv) Nov 10 23:30:06 aaa01 sshd[8702]: [ID 635154 auth.debug] PAM[8702]: pam_authenticate(cfdc8, 1) Nov 10 23:30:06 aaa01 sshd[8702]: [ID 232006 auth.debug] PAM[8702]: load_modules(cfdc8, pam_sm_authenticate)=/usr/lib/security/pam_radius_auth.so.1 Nov 10 23:30:06 aaa01 sshd[8702]: [ID 971319 auth.debug] PAM[8702]: load_function: successful load of pam_sm_authenticate Nov 10 23:30:06 aaa01 sshd[8702]: [ID 232006 auth.debug] PAM[8702]: load_modules(cfdc8, pam_sm_authenticate)=/usr/lib/security/pam_unix.so.1 Nov 10 23:30:06 aaa01 sshd[8702]: [ID 971319 auth.debug] PAM[8702]: load_function: successful load of pam_sm_authenticate Nov 10 23:30:06 aaa01 sshd[8702]: [ID 338151 auth.debug] PAM[8702]: pam_get_user(cfdc8, cfdc8, NULL) Nov 10 23:30:06 aaa01 sshd[8702]: [ID 801593 auth.debug] pam_radius_auth: Got user name red Nov 10 23:30:06 aaa01 sshd[8702]: [ID 801593 auth.debug] pam_radius_auth: Sending RADIUS request code 1 Nov 10 23:30:11 aaa01 sshd[8702]: [ID 801593 auth.error] pam_radius_auth: RADIUS server 172.24.43.230 failed to respond Nov 10 23:30:11 aaa01 sshd[8702]: [ID 801593 auth.error] pam_radius_auth: All RADIUS servers failed to respond. Nov 10 23:30:11 aaa01 sshd[8702]: [ID 801593 auth.debug] pam_radius_auth: authentication failed

1 0

RE: Couldn't open /etc/freeradius/users for reading: Permission denied
by Mitchell, Michael J 10 Nov '05

10 Nov '05

I think your problem is that the etc/raddb directory isn't readable/executable by your freerad user? If you run the server as root, it first reads the configuration files (radiusd.conf, clients.conf, proxy.conf, etc) then "setuid"'s to the configured "user" before instantiating the modules, etc. Hence, the server has no problem reading the configuration files first time round. > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] > Sent: Friday, 11 November 2005 7:12 AM > To: freeradius-users(a)lists.freeradius.org > Subject: Couldn't open /etc/freeradius/users for reading: > Permission denied > > > # ls -lha /etc/freeradius > total 244K > drwxr-s--- 3 root freerad 4.0K 2005-11-10 14:47 . > drwxr-xr-x 71 root root 4.0K 2005-11-10 16:29 .. > -rw-r----- 1 freerad freerad 422 2005-10-16 14:02 acct_users > -rw-r----- 1 freerad freerad 4.0K 2005-10-16 14:02 attrs > drwxr-s--- 3 freerad freerad 4.0K 2005-11-10 12:41 certs > -rw-r----- 1 freerad freerad 189 2005-10-16 14:02 clients

2 1

freeradius wont let realms based auth
by Andres Pazos 10 Nov '05

10 Nov '05

hi, im new to the mailing list. i'd be really thanked if someone could help me with the following issue: im trying to use freeradius with sql and mysql realm based (i.e.: sql when realm=dhcp and mysql when realm=wireless). i've red acct-type and tried to do the same. is that correct?, should i use acct-type?, what should i use instead?. Nevertheless, i'll add the debug of radtest, radiusd and radiusd.conf. radtest: root@andy:/var/log# radtest andy@wireless andy localhost 1812 testing123 Sending Access-Request of id 177 to 127.0.0.1:1812 User-Name = "andy@wireless" User-Password = "andy" NAS-IP-Address = andy NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=177, length=20 radiusd -X: rad_recv: Access-Request packet from host 127.0.0.1:32812, id=177, length=65 User-Name = "andy@wireless" User-Password = "andy" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "wireless" for User-Name = "andy@wireless" rlm_realm: Found realm "wireless" rlm_realm: Proxying request from user andy to realm wireless rlm_realm: Adding Realm = "wireless" rlm_realm: auth_port is not set. Proxy cancelled. modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 212 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 177 to 127.0.0.1:32812 Waking up in 4 seconds... thanks in advance!.

2 1

Running as root to authenticate against system accounts..
by Kevin Hanser 10 Nov '05

10 Nov '05

Hello, I've recently been looking into getting a FreeRADIUS server to authenticate against the system passwd file. When I was originally testing, it always seemed to reject my access, no matter what I tried. So I did some searching on the lists, and found another person that was having a similar issue. They discovered that the system only allows root to read the shadow password file, so when radius was requesting the password, it would get rejected. So I changed my setup to run the radiusd daemon as root, and tested again. Sure enough, if radiusd is run as root, I can authenticate against the system. So now my question is: What security concerns should I have if I run the radiusd as root? Is there another way to do this that doesn't require radiusd to run as root? Basically, I just want to make sure this is the best way to authenticate against system accounts, or if there's some other method that I've missed :) thx! k

2 2

Couldn't open /etc/freeradius/users for reading: Permission denied
by Dominik Benninger 10 Nov '05

10 Nov '05

hi everybody im trying to set up freeradius but i cant advance anymore because of this silly error. all information you need to know are down below. i might not see the wood for the trees, so please be easy on me! :-) # freeradius -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "shadow" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Couldn't open /etc/freeradius/users for reading: Permission denied Errors reading /etc/freeradius/users radiusd.conf[1035]: files: Module instantiation failed. # ls -lha /etc/freeradius total 244K drwxr-s--- 3 root freerad 4.0K 2005-11-10 14:47 . drwxr-xr-x 71 root root 4.0K 2005-11-10 16:29 .. -rw-r----- 1 freerad freerad 422 2005-10-16 14:02 acct_users -rw-r----- 1 freerad freerad 4.0K 2005-10-16 14:02 attrs drwxr-s--- 3 freerad freerad 4.0K 2005-11-10 12:41 certs -rw-r----- 1 freerad freerad 189 2005-10-16 14:02 clients -rw-r----- 1 freerad freerad 2.9K 2005-10-16 14:02 clients.conf -rw-r----- 1 freerad freerad 929 2005-10-16 14:02 dictionary -rw-r----- 1 freerad freerad 8.9K 2005-10-16 14:02 eap.conf -rw-r----- 1 freerad freerad 8.1K 2005-10-16 14:02 experimental.conf -rw-r----- 1 freerad freerad 2.4K 2005-10-16 14:02 hints -rw-r----- 1 freerad freerad 1.6K 2005-10-16 14:02 huntgroups -rw-r----- 1 freerad freerad 2.3K 2005-10-16 14:02 ldap.attrmap -rw-r----- 1 freerad freerad 9.2K 2005-10-16 14:02 mssql.conf -rw-r----- 1 freerad freerad 1020 2005-10-16 14:02 naslist -rw-r----- 1 freerad freerad 856 2005-10-16 14:02 naspasswd -rw-r----- 1 freerad freerad 12K 2005-10-16 14:02 oraclesql.conf -rw-r----- 1 freerad freerad 15K 2005-10-16 14:02 postgresql.conf -rw-r----- 1 freerad freerad 1.1K 2005-10-16 14:02 preproxy_users -rw-r----- 1 freerad freerad 8.7K 2005-10-16 14:02 proxy.conf -rw-r----- 1 freerad freerad 57K 2005-11-10 20:17 radiusd.conf -rw-r----- 1 freerad freerad 187 2005-10-16 14:02 realms -rw-r----- 1 freerad freerad 1.4K 2005-10-16 14:02 snmp.conf -rw-r----- 1 freerad freerad 14K 2005-10-16 14:02 sql.conf -rw-r----- 1 freerad freerad 6.8K 2005-11-10 20:03 users -rw-r----- 1 freerad freerad 7.1K 2005-10-16 14:02 x99.conf -rw-r----- 1 freerad freerad 4.1K 2005-10-16 14:02 x99passwd.sample

1 0