November 2005 - Freeradius-Users - lists.freeradius.org

Problem with EAP/TLS and XP SP2
by Hal Pomeranz 08 Nov '05

08 Nov '05

Radius Server: Freeradius 1.0.5 on Solaris 8 (Sparc) Client: Windows XP (SP2), Intel PRO/Wireless 2915 (a/b/g) Access Point: DLink DI-784 I'm having trouble getting my laptop (running Windows XP SP2) to authenticate to my access point using EAP/TLS. XP shows the wireless interface hung forever in "Attempting to authenticate" state. I've been beating my head against this all day without success, although I think I'm close and just missing something stupid and obvious. In the debugging log from "radiusd -X" below, I can see my laptop communicating with the radius server. I'm definitely seeing the correct username ("HalPomeranz") from the certificate I installed on the laptop. The radius server is finding the username entry in my "users" file. The only thing that looks like an error is the lines that read: rlm_eap_tls: >>> TLS 1.0 Handshake [length 005e], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A I Googled a bit for this error message and turned up some mailing list traffic describing similar problems, but no solutions. Perhaps this is a red herring, however. Note that I am successfully using this same radius server to authenticate some older clients which use LEAP to connect via a different access point, so I'm thinking my radius config is basically sound. Does anybody have any suggestions for how to resolve my problem? Anybody seen anything like this before? Thanks in advance... -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Hal Pomeranz, Founder/CEO Deer Run Associates hal(a)deer-run.com Network Connectivity and Security, Systems Management, Training -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /var/freeradius/etc/raddb/proxy.conf Config: including file: /var/freeradius/etc/raddb/clients.conf Config: including file: /var/freeradius/etc/raddb/snmp.conf Config: including file: /var/freeradius/etc/raddb/eap.conf Config: including file: /var/freeradius/etc/raddb/sql.conf main: prefix = "/var/freeradius" main: localstatedir = "/var/freeradius/var" main: logdir = "/var/freeradius/var/log/radius" main: libdir = "/var/freeradius/lib" main: radacctdir = "/var/freeradius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/freeradius/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/freeradius/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/var/freeradius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /var/freeradius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/freeradius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/var/freeradius/etc/raddb/certs/server_key.pem" tls: certificate_file = "/var/freeradius/etc/raddb/certs/server_cert.pem" tls: CA_file = "/var/freeradius/etc/raddb/certs/cacert.pem" tls: private_key_password = "" tls: dh_file = "/var/freeradius/etc/raddb/certs/dh" tls: random_file = "/var/freeradius/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = yes tls: check_cert_cn = "%{User-Name}" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/var/freeradius/etc/raddb/huntgroups" preprocess: hints = "/var/freeradius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/var/freeradius/etc/raddb/users" files: acctusersfile = "/var/freeradius/etc/raddb/acct_users" files: preproxy_usersfile = "/var/freeradius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/freeradius/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.100.4:1435, id=199, length=139 User-Name = "HalPomeranz" NAS-IP-Address = 192.168.100.4 NAS-Port = 0 Called-Station-Id = "00-0D-88-C5-20-71" Calling-Station-Id = "00-15-00-0E-F4-F5" NAS-Identifier = "DI-784" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020100100148616c506f6d6572616e7a Message-Authenticator = 0xe476642b4d621276fdcfa07fc848c5d6 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "HalPomeranz", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry HalPomeranz at line 101 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 199 to 192.168.100.4:1435 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf5332abd7af77b9911176ec9aa69e0e8 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.100.4:1435, id=200, length=221 User-Name = "HalPomeranz" NAS-IP-Address = 192.168.100.4 NAS-Port = 0 Called-Station-Id = "00-0D-88-C5-20-71" Calling-Station-Id = "00-15-00-0E-F4-F5" NAS-Identifier = "DI-784" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200500d800000004616030100410100003d030143696dabf9029fc190693ca4dc70364a394a56ff89289a020122f2e7346c770500001600040005000a000900640062000300060013001200630100 State = 0xf5332abd7af77b9911176ec9aa69e0e8 Message-Authenticator = 0x438ea47659b46e7e17bb9a54f66f02be Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "HalPomeranz", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry HalPomeranz at line 101 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0510], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 005e], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 200 to 192.168.100.4:1435 EAP-Message = 0x0103040a0dc0000005c7160301004a02000046030143696da6a2b012e765aa3f113c4c1ed6e28c40f51807859cd4394962388ae6e0202f9cf584c484b68b3aa0eb66ee1d1edec787b87407a2bf043891da3dc798f42b00040016030105100b00050c00050900024730820243308201aca003020102020101300d06092a864886f70d0101040500304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f636961746573301e170d3035313130323139323533385a170d3036313130323139323533385a3069310b300906 EAP-Message = 0x0355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f636961746573311a301806035504031311646565722e646565722d72756e2e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100c0511b635bded2881c4db827a89c521fbcc5a06b435b4ad56cd1b9b8ad0e78815ef2bd5d1e60e7a4c7f6b1a154cde960cf5de365fdd2fa462b3b90934d252245e87996b4031326e118dc68f9c9f6e3efb08958ba388f7677c47ecbf35514a74f27926b6a39d7f452c9caa2fb9d98fd3bdde64c4aa8f1b81228f502d1 EAP-Message = 0x117dcd5f0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010104050003818100243b1d366876ce82374e51d6e84e0a7e93a70558baad71a2a43ddc3602bc87df8c8d96fc2e903e1b68ae3bfdd5e1e8e1764d7d636d7bcdd0aa4a2f33598115ad1b6d90d43596654f4f956f26ad6cfc6d47330bc0d2a57e8e1998b9fc6da570c117a643bb699091f80f5aff0c44f6bb875ef27e0d79fbfda8ca01763debfff8960002bc308202b830820221a003020102020100300d06092a864886f70d0101040500304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d0603 EAP-Message = 0x5504071306457567656e65311c301a060355040a1313446565722052756e204173736f636961746573301e170d3035313130323139313931355a170d3036313130323139313931355a304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f63696174657330819f300d06092a864886f70d010101050003818d0030818902818100c16d27eab105d0e179e6a58207dd1b7d0c1a5a64f761506275abebf495254f4e242f9d13926e56bfe0bb8d9130afca9287746c12c5eed4f0ae5233ecc412bba6693cf9fad4e1db0f EAP-Message = 0x4f4b39c0f47ed5293975a9448d479ca38fbddeef68e1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf608c3c340e7dcd273e77d1ca5afd315 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.100.4:1435, id=201, length=147 User-Name = "HalPomeranz" NAS-IP-Address = 192.168.100.4 NAS-Port = 0 Called-Station-Id = "00-0D-88-C5-20-71" Calling-Station-Id = "00-15-00-0E-F4-F5" NAS-Identifier = "DI-784" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300060d00 State = 0xf608c3c340e7dcd273e77d1ca5afd315 Message-Authenticator = 0x399bf08221ad337dec5353e34d1f3f9e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "HalPomeranz", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry HalPomeranz at line 101 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 201 to 192.168.100.4:1435 EAP-Message = 0x010401d10d80000005c709eeaeeb99893a248df35086a268947b61542d3988e761db738040976f08e84fd7830203010001a381a73081a4301d0603551d0e0416041400b41eff09bcce9ad9f1b04ba50419a7db44a7f030750603551d23046e306c801400b41eff09bcce9ad9f1b04ba50419a7db44a7f0a151a44f304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f636961746573820100300c0603551d13040530030101ff300d06092a864886f70d010104050003818100b8ddea1e6f5851b78cca0feab23bd8 EAP-Message = 0x9b7d268ab9250ccd7a7d720d6c2cf103477a6445773dca5be28fd44611b9e4a2a9a6331550fbad950e21fea1ff8e70a3d178c9d1ebf13b12cd80d6ce561be9699a922a722207d4950140bb0aeb3d8b3e22021a83c91948f1903b4eaedb66a1288837436871f1a57bda39f374a3fb8af28b160301005e0d0000560201020051004f304d310b3009060355040613025553310f300d060355040813064f7265676f6e310f300d06035504071306457567656e65311c301a060355040a1313446565722052756e204173736f6369617465730e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x86870d983715d15f6919bdba762433c2 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 192.168.100.4:1435, id=202, length=147 User-Name = "HalPomeranz" NAS-IP-Address = 192.168.100.4 NAS-Port = 0 Called-Station-Id = "00-0D-88-C5-20-71" Calling-Station-Id = "00-15-00-0E-F4-F5" NAS-Identifier = "DI-784" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400060d00 State = 0x86870d983715d15f6919bdba762433c2 Message-Authenticator = 0xeda680bdf69e5dd588260e1c36169581 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "HalPomeranz", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry HalPomeranz at line 101 modcall[authorize]: module "files" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 202 to 192.168.100.4:1435 EAP-Message = 0x0105000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2b04eed7fe0be0ec28fbba826e52b47c Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 199 with timestamp 43696da6 Cleaning up request 1 ID 200 with timestamp 43696da6 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 201 with timestamp 43696da7 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 3 ID 202 with timestamp 43696da8 Nothing to do. Sleeping until we see a request.

4 7

compile issues with freeradius 1.0.5 on solaris 10
by Garrett.Marks＠wichita.edu 08 Nov '05

08 Nov '05

Hello, I was having problems compiling freeradius-1.0.5 on Solaris 10 (sparc) that were rather difficult to troubleshoot. I managed to get the compilation completed successfully, but it seems that maybe there could be some changes to improve the experience others have with compiling freeradius on Solaris 10 in the future. The problem I had, and another poster had, centers around configuring freeradius to compile with openssl. The full set of configure options I used were as follows: ./configure \ --prefix=/usr/local/freeradius \ --with-threads \ --with-ldap \ --with-openssl-includes=/usr/sfw/include/openssl \ --with-openssl-libraries=/usr/sfw/lib \ --with-rlm-ldap-include-dir=/usr/local/openldap/include \ --with-rlm-ldap-lib-dir=/usr/local/openldap/lib \ With no changes to my environment I get the following error: .... gcc -L../lib -o radwho radwho.o util.o log.o conffile.o -L/usr/sfw/lib -lssl -L/usr/sfw/lib -lcrypto -lnsl -lresolv -lsocket -lposix4 -lpthread -lradius -lcrypt Undefined first referenced symbol in file MD5Init ../lib/libradius.a(radius.o) (symbol belongs to implicit dependency /usr/lib/libmd5.so.1) MD5Final ../lib/libradius.a(radius.o) (symbol belongs to implicit dependency /usr/lib/libmd5.so.1) MD5Update ../lib/libradius.a(radius.o) (symbol belongs to implicit dependency /usr/lib/libmd5.so.1) ld: fatal: Symbol referencing errors. No output written to radwho ... The error does not occur when I run the configure from above leaving out the two openssl options. This was fixed by adding the following to my environment: LIBS=-lmd5 export LIBS * - This issue and workaround was mentioned by a previous poster. Should md5 be added to the list of libraries automatically defined during the configure process for the above? Then I get the following error: ... gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -I/usr/sfw/include/openssl -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../include -DHOSTINFO=\"\" -DRADIUSD_VERSION=\"1.0.5\" -c radclient.c radclient.c: In function `main': radclient.c:788: error: `RADIUS_DICTIONARY' undeclared (first use in this function) radclient.c:788: error: (Each undeclared identifier is reported only once radclient.c:788: error: for each function it appears in.) gmake[4]: *** [radclient.o] Error 1 gmake[4]: Leaving directory `/tmp/freeradius-1.0.5/src/main' ... This was a rather perplexing error as upon investigation of the radclient.c source and the freeradius-1.0.5/src/include directory, RADIUS_DICTIONARY is defined in ../include/conf.h and radclient.c has an include statement for conf.h. It is even more perplexing when investigating the gcc command from above, clearly the conf.h should be findable through the "-I../include" portion of the command. Following a suggestion, I set my CFLAGS env variable to CFLAGS="-I../include -I/usr/local/openldap/include" to force the -I../include to appear further up in the gcc command. To my surprise that allowed the compilation to finish successfully. After further investigation we discovered that there is also a "conf.h" file in the /usr/sfw/include/openssl directory which appears before the -I../include in the gcc command formed above. Therefore the radclient.c sees the openssl conf.h which does not have the `RADIUS_DICTIONARY' defined, thus the error. I checked the openssl source not from Sun and they have a "conf.h" as well. I could imagine a couple of possible fixes for this issue: 1) Modify configure to place the -I/usr/sfw/include/openssl (the ssl include path) to be after the -I../include? or 2) Change the name of conf.h to something more descriptive and specific to freeradius to avoid conflicts like this? Another interesting aspect is that with 1.0.4, it seems as if the --with-openssl-lib= option wasn't really working, because even with that set it wouldn't find ssl or libcrypt unless I set LD_LIBRARY_PATH. Now with 1.0.5 I don't have to set LD_LIBRARY_PATH. -Garrett Marks

2 1

Framed-Route and proxying
by Jason Frisvold 08 Nov '05

08 Nov '05

Hi there, I'm looking for a way to force certain users through a proxy. I *think* Framed-Routes are the way to go. Can someone help me out a little? Our users either dial in via a Patton RAS unit, or a Redback SMS-500. Any help would be appreciated. Thanks! -- Jason 'XenoPhage' Frisvold XenoPhage0(a)gmail.com

3 4

Strange issue.
by shadur＠systemec.nl 08 Nov '05

08 Nov '05

A while ago I upgraded our freeradius server to 1.0.2 from a 0.9.x version, and ever since our ISDN dial-up users can not gain access when their login type in radcheck is Crypt-Password. If I change them to a User-Password attribute and the cleartext password, it works. I've compiled a debug log at http://tenchi.systemec.nl/~shadur/radlog.txt with the SQL query outputs added below the queries where they are made. This exact setup worked with 0.9.x ; I've ru -- Rens Houben | opinions are mine Resident linux guru and sysadmin | if my employers have one Systemec Internet Services. |they'll tell you themselves PGP key at http://marduk.systemec.nl/~shadur/shadur.key.asc

2 1

RE: Solaris Make Problems
by Nicholas Thompson 08 Nov '05

08 Nov '05

I finally got freeradius to make without errors. However to do this I had to manually change the Makefile (in src/modules/rlm_sql/drivers/rlm_sql_mysql)and take out these options -x03 -mt and -xarch=v8, but I am not sure if this will affect the stability or useage of freeradius. >-xarch=v8 sounds like a Sun cc option. It's a good idea to work just with >one compiler, sun or gnu. Adjust the PATH that ./configure and make just >see on compiler. >I dont have the sun compiler. I am using GCC version 3.3.2 and the gnu linker version 2.14 >both of these are located in /usr/local/bin and that is the first directory in my path. > I am new to freeradius. I have a Solaris 8 machine with OpenSSL > version 0.9.8 and MySQL version 5.0.15 (max). Configure completes > without any problems however make fails. I have read many > suggestions on the list, and tries all of them. Such as setting the > LD_LIBRARY_PATH, I even tried to configure and make with just static > libraries. Could there be a problem with freeradius and MySQL5? > Here is a copy of the make output errors: > make[10]: Entering directory `/export/home/nicholas/freeradius-1.0. > 5/src/modules/rlm_sql/drivers/rlm_sql_mysql' > gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS - > DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith - > Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes - > Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W - > Wredundant-decls -Wundef -I../.. -I../../../../include - > I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 -c > sql_mysql.c -o sql_mysql.o > gcc: language arch=v8 not recognized > gcc: sql_mysql.c: linker input file unused because linking not done -xarch=v8 sounds like a Sun cc option. It's a good idea to work just with one compiler, sun or gnu. Adjust the PATH that ./configure and make just see on compiler. > /export/home/nicholas/freeradius-1.0.5/libtool --mode=link ld - > module -static -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS - > DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith - > Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes - > Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W - > Wredundant-decls -Wundef -I../.. -I../../../../include - > I/usr/local/mysql/include -xO3 -mt -D_FORTEC_ -xarch=v8 sql_mysql.o > -o rlm_sql_mysql.a > (cd . && ln -s sql_mysql.lo sql_mysql.o) > ln: cannot create sql_mysql.o: File exists > make[10]: *** [rlm_sql_mysql.a] Error 2 --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

2 1

Re: Freeradius the right tool as Windows Authentication Proxy?
by Thomas Stieglitz 08 Nov '05

08 Nov '05

Hello Helen, thank you for your informative answer! > It's possible, but I don't think RADIUS is the right tool. Which one or which technics do you think ist the right solution for my problem? Greetings, Tom Stieglitz FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> schrieb am 07.11.05 18:38:23: > > Thomas Stieglitz <Starglider7(a)web.de> wrote: > > We're running an apache 1.X webserver, which is located at an > > external provider. My problem is, that we need to authenticate > > webusers against our Windows 2000 Active Directory, which is located > > in our companies' local network. > > I would recommend using an Apache module for this task. Maybe > mod_ntlm, or mod_smb would be appropriate. > > > 1) Is this idea a possible solution ... the right use of an radius-server? And, if yes: is freeradius the right tool for it? > > It's possible, but I don't think RADIUS is the right tool. > > > 2) If yes: Is it also possible, to gain group information about a user. (i. e. Is Fred Member of Group Foo? Which groups is Fred member of?) > > Yes, but you can't use RADIUS to send that information to Apache. > > > 3) if yes: how do I find an entry point for further information about this special subject? > > If the documentation doesn't already contain the information you > need, use google to search mailing list archives. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ______________________________________________________________ Verschicken Sie romantische, coole und witzige Bilder per SMS! Jetzt bei WEB.DE FreeMail: http://f.web.de/?mc=021193

3 2

Cisco AP Vlan assignment when proxying EAP-PEAP?
by Palmer J.D.F. 08 Nov '05

08 Nov '05

Hi, Can anyone tell me if it's possible to proxy EAP-PEAP from a Cisco Aironet to an IAS server via FreeRADIUS (I can do this bit), then, set the user's VLAN information within FreeRADIUS in the access-accept packet returned to the AP? Also, is there a way to return an access-accept with a 'dirty' VLAN ID, even if the IAS server rejects the user? The idea being that the user would be put into a dead end VLAN so they could get info on how to register to use the service. Many thanks, Jezz Palmer. **************************************** Jezz Palmer. Internet Systems Officer. Library and Information Services University of Wales, Swansea Singleton Park Swansea SA2 8PP ****************************************

2 1

Radius died, restarting
by hannibal 08 Nov '05

08 Nov '05

i use radwatch to check the status of the radiusd, but it keeps sending "Radius died, restarting" mail to me, but radiusd runs well if i donnot run radwatch. pls tell why, thanks.

1 0

ntlm_auth commandline ok, radius not ok
by Völker, Christian 08 Nov '05

08 Nov '05

Yohoo! I've a (for me) strange problem mit ntlm_auth. I want to use freeradius as an proxy for authentication against ActiveDirectory. So I've installed winbind. "wbinfo -u" and "wbinfo -g" shows me the User and Grouplists. Nice :) I've configured freeradius like Alan DeKok showed in his posting from Tue Jul 12 18:33:05 CEST 2005: -----------snip--------------- modules { ... exec win_domain { wait = yes input_pairs = request output_pairs = reply program = "ntlm_auth --username=\"%{User-Name}\" --password=\'%{User-Password}\' --domain=mydomain" } ... } Now list "win_domain" in the "authenticate" section, and add the following entry to the "users" file: DEFAULT Auth-Type = win_domain -----------snip--------------- When I start ntlm_auth on command line: server:/# /usr/bin/ntlm_auth --username='_web' --password='XXXXX!' --domain=mydomain NT_STATUS_OK: Success (0x0) All is ok. :) Trying the same with radtest: ldaptest02:/etc/raddb# radtest "_web" 'XXXXX!' localhost 10 testing123 Sending Access-Request of id 75 to 127.0.0.1:1812 User-Name = "_web" User-Password = "XXXXX!" NAS-IP-Address = ldaptest NAS-Port = 10 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=75, length=20 Nothing is ok :-( Logfiles: -----------snip--------------- Nov 8 13:58:57 ldaptest radiusd: modcall: group authorize returns ok for request 8 Nov 8 13:58:57 ldaptest radiusd: rad_check_password: Found Auth-Type win_domain Nov 8 13:58:57 ldaptest radiusd: auth: type "win_domain" Nov 8 13:58:57 ldaptest radiusd: Processing the authenticate section of radiusd.conf Nov 8 13:58:57 ldaptest radiusd: modcall: entering group Auth-Type for request 8 Nov 8 13:58:57 ldaptest radiusd: radius_xlat: '/usr/bin/ntlm_auth --username='_web' --password='XXXXX!' --domain=central' Nov 8 13:58:57 ldaptest radiusd: Exec-Program: /usr/bin/ntlm_auth --username='_webman' --password='XXXXX!' --domain=central Nov 8 13:58:57 ldaptest radiusd: Exec-Program output: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) Nov 8 13:58:57 ldaptest radiusd: Exec-Program-Wait: plaintext: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) Nov 8 13:58:57 ldaptest radiusd: Exec-Program: returned: 1 Nov 8 13:58:57 ldaptest radiusd: rlm_exec (win_domain): External script failed Nov 8 13:58:57 ldaptest radiusd: modcall[authenticate]: module "win_domain" returns fail for request 8 -----------snip--------------- The line in the log is the same as I enter it at command line. Why is the answer different? Thanks for your help and/ or ideas for problem solution! Greets from Germany Christian

1 0

Ldap truncating output
by Pedro Marcolino 08 Nov '05

08 Nov '05

Hi, I've installed the latest version of freeradius(1.0.5), and when using it with LDAP i'm having some problems. Some output is being truncated( mainly in cisco-avpairs ): rlm_ldap: performing search in o=radius, with filter (uid=wy09jmru) rlm_ldap: Added password i2dhmljk in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding ispRadiusLoginLimit as Simultaneous-Use, value 1 & op=21 rlm_ldap: Adding ispRadiusAuthType as Auth-Type, value 1 & op=21 rlm_ldap: Adding ispRadiusPassword as User-Password, value password & op=21 rlm_ldap: Adding ispRadiusUserName as User-Name, value wy09jmru & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding ispRadiusCiscoAVPair as Cisco-AVPair, value lcp:interface-config & op=11 rlm_ldap: Adding ispRadiusCiscoAVPair as Cisco-AVPair, value lcp:interface-config & op=11 rlm_ldap: Adding ispRadiusFramedIPAddress as Framed-IP-Address, value 12.1.1.8 & op=11 rlm_ldap: Adding ispRadiusFramedProtocol as Framed-Protocol, value 1 & op=11 rlm_ldap: Adding ispRadiusServiceType as Service-Type, value 2 & op=11 rlm_ldap: user wy09jmru authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type 1 auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 2 rlm_ldap: - authenticate rlm_ldap: login attempt by "wy09jmru" with password "password" rlm_ldap: user DN: uid=wy09jmru,ou=People,o=xxx.xxx,o=Radius rlm_ldap: (re)connect to ldap:389, authentication 1 rlm_ldap: bind as uid=wy09jmru,ou=People,o=xxx.xxx,o=Radius/i2dhmljk to ldap:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user wy09jmru authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 2 modcall: group Auth-Type returns ok for request 2 Processing the session section of radiusd.conf modcall: entering group session for request 2 radius_xlat: 'wy09jmru(a)xxx.xxx' rlm_sql (sql): sql_set_user escaped user --> 'wy09jmru(a)xxx.xxx' radius_xlat: 'SELECT COUNT(*) FROM radacct WHERE UserName='wy09jmru(a)xxx.xxx' AND AcctStopTime = 0' rlm_sql (sql): Reserving sql socket id: 8 rlm_sql (sql): Released sql socket id: 8 modcall[session]: module "sql" returns ok for request 2 modcall: group session returns ok for request 2 Sending Access-Accept of id 7 to 10.16.2.10:55521 Cisco-AVPair = "lcp:interface-config" Framed-IP-Address = 12.1.1.8 Framed-Protocol = PPP Service-Type = Framed-User Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... Ldapsearch show the following: (...) ispRadiusCiscoAVPair: lcp:interface-config#1=ip vrf forwarding v24:xxx ispRadiusCiscoAVPair: lcp:interface-config#2=ip unnumbered loopback14 (...) Anyone got the same problem? Thanks for the time. Best Regards, Pedro Marcolino

2 2