December 2005 - Freeradius-Users - lists.freeradius.org

RE: FreeRadius and Dlink Switch Authentication Problem
by Kai Geek 29 Dec '05

29 Dec '05

Merhabalar Inci hanim, oncelikle yardimlariniz icin cok tesekkur ederim. Ancak tacacs kullanamiyoruz cunku switchlerin cogu Dlink ve 3226 modeli yani tacacs yok. radius server destekliyorlar. bu nedenle radius kullanmam gerek. #radiusd -X diyerek debug moda aliyorum ve benim ip adresim 10.0.0.185 radius server ise 10.0.0.6'da calisiyor. switch ise (dlink marka) 10.0.0.250 ip adresine sahip. ben #telnet 10.0.0.250 komutunu verdigim zaman switchin kendi icindeki kullanici ile (admin) girebiliyorum. ama hicbir log dusmuyor. ne onerirsiniz? ----- Original Message ----- From: "Inci Gedik " <igedik(a)ford.com.tr> To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Subject: RE: FreeRadius and Dlink Switch Authentication Problem Date: Thu, 29 Dec 2005 15:20:43 +0200 > > Selam, > > Radius un debug ettin mi ? Sen switch e baglanmaya calisirken ekrana neler > geliyor bir bakar misin ? Birde calisan bir sistemden ornek veriim : > > client.conf dosyani asagidaki gibi editler misin ? > > client 10.0.0.250 { > secret = 250 > shortname = switch > nastype = cisco > } > > Users dosyasindaki kulanici tanimlamasini asagidaki gibi yapip, linux > sisteminde steve diye bir kullanici acip bir de sifre verirsen baglantiyi > saglayabilirsin. > > steve Auth-Type := System > Service-Type = Shell-User, > Login-Service = Telnet, > Login-IP-Host = 0.0.0.0, > Login-TCP-Port = Telnet > > Linux altinda port numaralarinda acik degil mi ? Bu sekilde bir kontrol > edersen bir de conf dosyani inceleyebiliriz. O zaman conf dosyanda bir hata > var demektir. > > Bi de israrla tacacs+ diyorum : ) > > > > Kolay gelsin , > > Inci Gedik > > -----Original Message----- > From: freeradius-users-bounces+igedik=ford.com.tr(a)lists.freeradius.org > [mailto:freeradius-users-bounces+igedik=ford.com.tr@lists.freeradius.org] On > Behalf Of Kai Geek > Sent: 29 Aralık 2005 Perşembe 14:24 > To: freeradius-users(a)lists.freeradius.org > Subject: FreeRadius and Dlink Switch Authentication Problem > > Hello, > i am using freeradius in my computer with the ip 10.0.0.6 > i have a dlink 3226s model switch in my network and its ip is 10.0.0.250 > > i want this switch to verify username and password from radius server > (10.0.0.6) > > i have added 10.0.0.250 as a client to the radius servers clients.conf and > users files and i introduced a user. but still it doesnt connect. where may > be the error? > when i test locally, it seems as working but teh switch doesnt connect to > radius? > thank you, > > using command radius server (10.0.0.6) > > kernel@debian#pico clients.conf > > client 10.0.0.250 { > secret = 250 > shortname = 1 > } > > kernel@debian#pico users > > steve Auth-Type := Local, User-Password == "testing" > Service-Type = Framed-User, > Framed-Protocol = PPP, > Framed-IP-Address = 127.0.0.1, > Framed-IP-Netmask = 255.255.255.0, > Framed-Routing = Broadcast-Listen, > Framed-Filter-Id = "std.ppp", > Framed-MTU = 1500, > Framed-Compression = Van-Jacobsen-TCP-IP > > #radtest steve testing 10.0.0.6 1812 testing > okay > what problem ? > when i test locally, it seems as working but teh switch doesnt connect to > radius? > > +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ > Version: GnuPG v1.4.2 (GNU/Linux) > .-. .-. _ > : : : : :_; > .-' : .--. : `-. .-. .--. ,-.,-. > ' .; :' '_.'' .; :: :' .; ; : ,. : > `.__.'`.__.'`.__.':_;`.__,_;:_;:_; > > Kai "Ozgur" Geek > Network Engineer > PGP ID: B1B63B6E > +-+-+-+ END PGP SIGNATURE +-+-+-+ > > > -- > _______________________________________________ > Check out the latest SMS services @ http://www.linuxmail.org > This allows you to send and receive SMS through your mailbox. > > Powered by Outblaze > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) .-. .-. _ : : : : :_; .-' : .--. : `-. .-. .--. ,-.,-. ' .; :' '_.'' .; :: :' .; ; : ,. : `.__.'`.__.'`.__.':_;`.__,_;:_;:_; Kai "Ozgur" Geek Network Engineer PGP ID: B1B63B6E +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

2 1

FreeRadius and Dlink Switch Authentication Problem
by Kai Geek 29 Dec '05

29 Dec '05

Hello, i am using freeradius in my computer with the ip 10.0.0.6 i have a dlink 3226s model switch in my network and its ip is 10.0.0.250 i want this switch to verify username and password from radius server (10.0.0.6) i have added 10.0.0.250 as a client to the radius servers clients.conf and users files and i introduced a user. but still it doesnt connect. where may be the error? when i test locally, it seems as working but teh switch doesnt connect to radius? thank you, using command radius server (10.0.0.6) kernel@debian#pico clients.conf client 10.0.0.250 { secret = 250 shortname = 1 } kernel@debian#pico users steve Auth-Type := Local, User-Password == "testing" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 127.0.0.1, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP #radtest steve testing 10.0.0.6 1812 testing okay what problem ? when i test locally, it seems as working but teh switch doesnt connect to radius? +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) .-. .-. _ : : : : :_; .-' : .--. : `-. .-. .--. ,-.,-. ' .; :' '_.'' .; :: :' .; ; : ,. : `.__.'`.__.'`.__.':_;`.__,_;:_;:_; Kai "Ozgur" Geek Network Engineer PGP ID: B1B63B6E +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

3 2

openssl fails
by pelusa vali 29 Dec '05

29 Dec '05

hi everybody, well finally get install openssl v0.9.8a, now when i try to generate certificates to be used with freeradius (eap-tls or eap-peap) i use these command to CERTIFICATE AUTHORITY GENERATION: #openssl req -new -x509 -keyout newreq.pem -out newreq.pem -passin pass:clue1 -passout pass:clue1 #openssl pkcs12 -export -in demoCA/cacert.pem -inkey newreq.pem -out root.p12 -cacerts -passin pass:clue1 -passout pass:clue1 #openssl pkcs12 -in root.p12 -out root.pem -passin pass:clue1 -passout pass:clue1 (i copied root.p12 from freeradius files) #openssl x509 -inform PEM -outform DER -in root.pem -out root.der #rm -rf newreq.pem and these to SERVER CERTIFICATE GENERATION: #openssl req -new -keyout newreq.pem -out newreq.pem -passin pass:whatever -passout pass:clue1 #openssl ca -policy policy_anything -out newcert.pem -passin pass:whatever -key whatever -extensions xpserver_ext -extfile xpextensions -infiles newreq.pem right here, when using this command i get this error: Error opening CA private key ./demoCA/private/cakey.pem 4161:error:02001002:system library:fopen:No such file or directory:bss_file.c:349:fopen ('./demoCA/private/cakey.pem' ,'r') 4161:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:351: unable to load CA private key well i really don't understand what this mean but reviewed ./demoCA/private/cakey.pem and effectively it's there, so why openssl cann't locate it?? why unable to load CA private key?? so, i tried this: #openssl x509 -inform PEM -outform DER -in demoCA/cacert.pem -out demoCA/cacert.der but now get this: 4201:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:644:Expecting: TRUSTED CERTIFICATE excuse if this question is so trivial but i really don't understand it. could any body help and tell me what is happening?? thanks for your patience and help. _________________________________________________________________ Las mejores tiendas, los precios mas bajos, entregas en todo el mundo, YupiMSN Compras: http://latam.msn.com/compras/

2 1

Re:no response from server on other machine
by yao guoxian 29 Dec '05

29 Dec '05

> If the server doesn't respond on localhost, then either it isn't >running, or you edited the configuration files to break it. > Alan DeKok. Thank you for your suggestion. The fact is Radius works correctly on the localmachine (the same machine on which FreeRadius 1.0.5 was installed).However, when a authentication request was sent to Radius Server from the other machine. The request got no response. I don't know the reason. Can you give me a detail on how to resovle the problem?

4 3

Selecting one of multiple Ldap server in users file
by Gerald Richter 29 Dec '05

29 Dec '05

Hi, I want to use more than one ldap server to authenticate users. I have setup a users file that sets the Autz-Type so one of two ldap server are selected for authorization. Since it is not known which kind of authentication information is provied by the user, chap is also included, like Authorize { preprocess suffix file Auth-Type aldap1 { chap ldap1 } Auth-Type aldap2 { chap ldap2 } } My problem is now when it comes the authentication, because both instances of the ldap module sets the Auth-Type to LDAP, it will only work with one ldap server. Also I cannot set the Auth-Type in the users file, because it might also be set to CHAP by the chap module. How can I specify which ldap server to use for authentication in such a case? Is there a possibility to include the module instance name in the Auth-Type? Thanks Gerald --------------------------------------------------------------------------- Gerald Richter ecos electronic communication services gmbh IT-Securitylösungen * Webapplikationen mit Apache/Perl/mod_perl/Embperl Post: Tulpenstrasse 5 D-55276 Dienheim b. Mainz E-Mail: richter(a)ecos.de Voice: +49 6133 939-122 WWW: http://www.ecos.de/ Fax: +49 6133 939-333 --------------------------------------------------------------------------- ECOS BB-5000 Firewall- und IT-Security Appliance: www.bb-5000.info --------------------------------------------------------------------------- ** Virus checked by BB-5000 Mailfilter **

3 6

Adapting Reply-Msg to Reject cause
by Yannick Deltroo 28 Dec '05

28 Dec '05

Hello, I'm using Freeradius with rlm_sql & sqlcounter to authorize access to hotspots. I would like to set a specific Reply-Message (which is displayed in the user browser) depending the Reject cause, for instance: - Reply-Msg="Account has expired" (if reject because of Expiration == XXXX) - Reply-Msg="Time credit is exhausted" (if reject because of Max-All-Session := XXXX) - Reply-Msg="Access not allowed from this NAS" (if reject because of Nas-Identifier !=XXXX) - Reply-Msg="Wrong password" (if cannot authenticate) How can I do that without writing a custom authorization script ? Thanks for yout help. Yannick Deltroo

1 0

AcctStopTime - AccStartTime != AcctSessionTime
by Ezequiel O. Block 28 Dec '05

28 Dec '05

Hi to all, +----------+---------------------+---------------------+-----------------+ | UserName | AcctStartTime | AcctStopTime | AcctSessionTime | +----------+---------------------+---------------------+-----------------+ | pepe | 2005-12-02 16:24:45 | 2005-12-02 16:25:46 | 63 | | pepe | 2005-12-02 16:26:23 | 2005-12-02 16:27:12 | 52 | | pepe | 2005-12-02 16:29:02 | 2005-12-02 16:29:09 | 9 | | pepe | 2005-12-02 17:43:37 | 2005-12-02 18:03:32 | 1197 | | pepe | 2005-12-02 18:09:16 | 2005-12-02 18:15:45 | 391 | First line should be 61 Second line should be 49 Third line should be 7 etc. In some rows there are even bigger differences, shouldn´t be AcctSessionTime the difference of AcctStopTime - AcctStartTime ? Thanks in advance, Ezequiel. -- Ezequiel O. Block Cooperativa La Lonja, Servicios de Internet. T 02322-474537 F 02322-470406 E ezequielb(a)pilar-ciudad.com.ar

2 1

Re: EAP-MD5 Authentication problem
by Marco Spiga 28 Dec '05

28 Dec '05

Hello!!! I don't know why the 'radeapclient -s -xx 127.0.0.1 auth testing123 <req.txt' command don't authenticate whith radiusd. The req.txt file contains: User-Name = "test" User-Password = "password" EAP-MD5-Password = "password" NAS-IP-Address = 127.0.0.1 NAS-Port = 10 EAP-Code = Response Called-Station-Id = "00-06-25-57-18-B6" Calling-Station-Id = "00-06-23-27-38-E6" EAP-Id = 210 EAP-Type-Identity = "test" Message-Authenticator = 0x0 -------------------------------------------------------------------- the radius.conf file contain: modules { ... eap { default_eap_type = md5 md5 { } ... } ... } authorize { ... eap } authenticate { eap } the eap.conf file contain: eap { default_eap_type = md5 md5 { } } the users file contain: "test" Auth-Type := EAP, User-Password == "password" Reply-Message = "Hello, %u" Where is the error ? Please. Bye!

3 5

Problem with freeRadius +openssle +EAP/TLs
by Adam Rogalski 28 Dec '05

28 Dec '05

Hi folks I'm new here and I'm trying to configure Radius for my home wireless network. I use RADIUS on fedora core 4, my AP is WRT54G and clients are on WindowsXp sp2. I made everythig with "how to" on page http://www.linuxjournal.com/article/8095. But I still don't have authentication with Radius. In radius log I get message rlm_eap_tls: Length Included Wed Dec 28 15:41:18 2005 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Dec 28 15:41:19 2005 : Info: rlm_eap_tls: Length Included Wed Dec 28 15:41:19 2005 : Error: --> verify error:num=20:unable to get local issuer certificate Wed Dec 28 15:41:19 2005 : Error: TLS Alert write:fatal:unknown CA Wed Dec 28 15:41:19 2005 : Error: TLS_accept:error in SSLv3 read client certificate B Wed Dec 28 15:41:19 2005 : Error: rlm_eap_tls: SSL_read failed in a system cal When I try to do radiusd -X -A I get Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/server_keycert.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/server_keycert.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "adam01" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. And now nothing is happen. So if you now how please help me

1 0

radius error file
by Kai Geek 28 Dec '05

28 Dec '05

#tail -f /var/log/radius/radius.log Wed Dec 28 13:31:21 2005 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Dec 28 13:31:21 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Dec 28 13:31:21 2005 : Info: Ready to process requests. why problem in radius server ? -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

2 1