May 2005 - Freeradius-Users - lists.freeradius.org

LEAP
by Luis Daniel Lucio Quiroz 02 Jun '05

02 Jun '05

Ehlo We are usign Cisco1200 AP for roaming, but AP needs to auth into radius. Because CISCO it must use LEAP. But it fails on this rlm_eap: EAP/leap rlm_eap: processing type leap rlm_eap_leap: No User-Password or NT-Password configured for this user rlm_eap: Handler failed in EAP/leap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 3 EAP with TLS and PEAP works well. LDAP user exists uid: AP-DATI userrPassword: cisco1234 sambaNTPassword: 3B298390489F668CA3C38047C7FE1266 sambaLMPassword: 8BE57A0FA91F460C19F10A933D4868DC How should I fix this? Regards,

4 6

How to authenticate users against a Windoze AD server with krb5?
by Arne Götje (高盛華) 01 Jun '05

01 Jun '05

Hi list, I'm trying to authenticate users against a Windows AD server using the krb5 module... but due to missing documentation on how to do this, I'm stuck. When I try to get a Kerberos ticket using kinit on the radius machine, it works. But when I try to use the krb5 module, it always gives me a Reject... Is there anywhere a detailed howto available? Google didn't help me much... :( Cheers Arne -- Arne Götje (高盛華) <arne(a)linux.org.tw> PGP/GnuPG key: 1024D/685D1E8C Fingerprint: 2056 F6B7 DEA8 B478 311F 1C34 6E9F D06E 685D 1E8C Key available at wwwkeys.pgp.net. Encrypted e-mail preferred.

3 4

How to? - use/configure winbind/ntlm_auth for Windows authentication
by Pete Flynt 01 Jun '05

01 Jun '05

Hello, I'm trying to set up a FreeRadius solution for a Windows2k AD environnment. The FreeRadius-server is already running right. I can authenticate a testuser with Auth-Type := EAP (username and password stored as cleartext in the users file) Now I want to use FreeRadius to check username/password from the Active Directory Server when a user logs onto the computer. I checked the list already. Some say to use ntlm_auth and winbind, others LDAP, then samba... but nobody is able to explain how to get it working. Is it really as complicated? ntlm_auth seems very simple, returnig 1 if user/pwd is alright and 0 when not. But how can I test this from the command line? Where do I specify the address of the AD-server? When running ntlm_auth -- usage there are too much parameters that are unknown to me. Thanks in advance for any help! Pete _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 1

Certificate creation????
by Andreas Korber 01 Jun '05

01 Jun '05

Hi, What i am doing wrong? The creation of my certificates for EAP/TLS with CA.all or CA.certs always end with an message like this: ----- Country Name (2 letter code) [AU]:State or Province Name (full name) [Some-State]:Locality Name (eg, city) []:Organization Name (eg, company) [Internet Widgits Pty Ltd]:Organizational Unit Name (eg, section) []:Common Name (eg, YOUR name) []:Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:An optional company name []:Using configuration from /etc/ssl/openssl.cnf ./demoCA/serial: No such file or directory error while loading serial number 3164:error:02001002:system library:fopen:No such file or directory:bss_file.c:276:fopen('./demoCA/serial','r') 3164:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:278: Failed to do sign certificate radius:/usr/local/etc/raddb/certs # So i looked for the serial file. But it dosn´t exist. I think because of an earlier message: CA certificate filename (or enter to create) unknown option -next_serial usage: x509 args -inform arg - input format - default PEM (one of DER, NET or PEM) -outform arg - output format - default PEM (one of DER, NET or PEM) -keyform arg - private key format - default PEM -CAform arg - CA format - default PEM -CAkeyform arg - CA key format - default PEM -in arg - input file - default stdin -out arg - output file - default stdout -passin arg - private key password source -serial - print serial number value -hash - print hash value -subject - print subject DN -issuer - print issuer DN -email - print email address(es) -startdate - notBefore field -enddate - notAfter field -purpose - print out certificate purposes -dates - both Before and After dates -modulus - print the RSA key modulus -pubkey - output the public key -fingerprint - print the certificate fingerprint -alias - output certificate alias -noout - no certificate output -ocspid - print OCSP hash values for the subject name and public key -trustout - output a "trusted" certificate -clrtrust - clear all trusted purposes -clrreject - clear all rejected purposes -addtrust arg - trust certificate for a given purpose -addreject arg - reject certificate for a given purpose -setalias arg - set certificate alias -days arg - How long till expiry of a signed certificate - def 30 days -checkend arg - check whether the cert expires in the next arg seconds exit 1 if so, 0 if not -signkey arg - self sign cert with arg -x509toreq - output a certification request object -req - input is a certificate request, sign and output. -CA arg - set the CA certificate, must be PEM format. -CAkey arg - set the CA key, must be PEM format missing, it is assumed to be in the CA file. -CAcreateserial - create serial number file if it does not exist -CAserial arg - serial file -set_serial - serial number to use -text - print the certificate in text form -C - print out C code forms -md2/-md5/-sha1/-mdc2 - digest to use -extfile - configuration file with X509V3 extensions to add -extensions - section from config file with X509V3 extensions to add -clrext - delete extensions before signing and input certificate -nameopt arg - various certificate name options -engine e - use engine e, possibly a hardware device. -certopt arg - various certificate text options Can anyone help me plaese??

3 2

Freeradius+mysql error
by Rupak 31 May '05

31 May '05

I configured freeradius it was working well.Now I wanted to make it work with my sql.My distro is redhat9 and I am using the version mysql-3.23.54a-11.rpm.Free radius was working and authenticating user.But after configuring the files to make it work with sql it is not working well.It gave me the following errors.I did exactly that was defined in the resources.Like in the forum section of chillispot.org .Tutorial was posted by barteki. And other sites as well. root@chillispot rlm_sql_mysql]# radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded SQL Counter Module: Instantiated sqlcounter (noresetcounter) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded SQL rlm_sql (sql): Could not link driver rlm_sql_mysql: file not found rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. radiusd.conf[14]: sql: Module instantiation failed. Can any one point me to a correct lane. Thanking you

5 11

Please resend this message to Kim Jones'
by Kim 31 May '05

31 May '05

Please resend this message to Kim Jones' new email address. Thank You. kim(a)omegatechinc.com

3 2

Format of Framed-IPv6-Prefix Attribute
by Seema Sirivara 31 May '05

31 May '05

Hi, Can anybody please let me know the usage format of Framed-IPv6-Prefix attribute. I need to use in a user file record, but radius does not seem to send out the correct address. The attribute is of type octets and hence I cannot specify the Prefix in standard IPv6 address format.. (Ex - 3001::1 etc) I am using FreeRADIUS Version 0.9.3. Thanks, /Seema __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Authenticating Active Directory users via LDAP
by Pete Flynt 31 May '05

31 May '05

Hello, My network environment looks like the following: WinXP client --- Cisco Switch --- FreeRadius Server --- DC(Active Directory) I am able to authenticate the WinXP client with the local users file and EAP. Now I want FreeRadius to lookup the user credentials in Active Directory. I configured the LDAP modules and I am able to access Active directory for username lookup but the authentication fails because of the password that cannot be supplied in cleartext. The problem is, that I must use EAP because of 802.1X between the switch and the WinXP client. How can I solve this issue? I have read somewhere about how to modify FreeRadius source code in order to get EAP working with AD. I would appreciate a simpler solution. Any suggestion? Here is some output of radiusd: rlm_ldap: - authorize rlm_ldap: performing user authorization for pete radius_xlat: '(sAMAccountName=pete)' radius_xlat: 'cn=Users, dc=testdc' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=Users, dc=testdc, with filter (sAMAccountName=pete) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user pete authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap_md5: User-Password is required for EAP-MD5 authentication rlm_eap: Handler failed in EAP/md5 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 1 modcall: group authenticate returns invalid for request 1 auth: Failed to validate the user. Login incorrect: [pete] (from client 192.168.33.44 port 0 cli 00-11-43-5c-77-d6) Delaying request 1 for 1 seconds Finished request 1 Going to the next request Regards, Pete _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1

radius + peap + wifi + mac os x
by Vittore Zen 31 May '05

31 May '05

Hi, I'm using freeradius (+mysql) in a wireless infrastructure with a dozen of linksys WAP54G access point (using AES). Authentication is PEAP with mschapv2. All go right when use Windows clients but no response using Mac Os X clients. Any ideas? Someone says me that MacOsX use a tunnel with md5 nor mschapv2. Note that is server starts with -X no authentication is required from MacOsX client. thanks in advance v.

3 2

Forwarding
by Maxim Hitrov 31 May '05

31 May '05

Hello I have a radius server that receives Access-Requests params from another Server (an application). Application sends an value under one param (Framed-IP-Address), but Radius server are configured to read this value in another param (Calling-Station-Id). So, i need to have something intermediate, that receives value of Framed-IP-Address and sends it to Radius server as Calling-Station-Id. Application and Radius server can't be configured to use the same value in the same request param! Can i use FreeRadius as intermadiate Radius that will change and forward Access-Requests params? Give me some examples, and what i need to read for doing this. Thank you --------------------------------- Do You Yahoo!? Yahoo! Small Business - Try our new Resources site!

2 1

Freeradius 1.0.2 crashes in startup due tls
by Mikko Saarinen 31 May '05

31 May '05

Hey, Not sure if this would belong to devel list, but still. I'm trying to test the PEAP support, but Freeradius 1.0.2 dies when it loads and configures the tls module. In older version 0.9.3 the tls works a-ok, but it has no peap support. Anyone have idea if this is a known problem and if there is version in which the peap runs. OpenSSL version: OpenSSL 0.9.7e 25 Oct 2004 Here is the log and stack from running radiusd -X under gdb: (gdb) run -X Starting program: /usr/local/sbin/radiusd -X (no debugging symbols found) [Thread debugging using libthread_db enabled] [New Thread 16384 (LWP 5377)] Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: bind_address = 192.168.1.50 IP address [192.168.1.50] main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/foocerts/privkey.pem" tls: certificate_file = "/usr/local/etc/raddb/foocerts/cacert.pem" tls: CA_file = "/usr/local/etc/raddb/foocerts/cacert.pem" tls: private_key_password = "SecretKeyPass77" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes rlm_eap_tls: conf N ctx stored rlm_eap: Loaded and initialized type tls Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 16384 (LWP 5377)] 0x400630df in lt_dlsym (handle=0x815e3f0, symbol=0xbfffe970 "rlm_eap_peap") at ltdl.c:3330 3330 lensym = LT_STRLEN (symbol) + LT_STRLEN (handle->loader->sym_prefix) (gdb) bt #0 0x400630df in lt_dlsym (handle=0x815e3f0, symbol=0xbfffe970 "rlm_eap_peap") at ltdl.c:3330 #1 0x402324c7 in eaptype_load (type=0xc, eap_type=12, cs=0xc) at eap.c:114 #2 0x40231aea in eap_instantiate (cs=0x80a7410, instance=0xc) at rlm_eap.c:134 #3 0x080558f3 in find_module_instance () #4 0x08056cd5 in modcall () #5 0x08056e32 in compile_modsingle () #6 0x08055dad in find_module_instance () #7 0x08056144 in setup_modules () #8 0x0804cea0 in main () (gdb) -- Mikko Saarinen mikko.saarinen(a)radionet.com

2 1

dynamic ip, shared secret
by glanzel＠gmx.de 31 May '05

31 May '05

Hello i want to allow nas's behind a flatrate to talk with my freeradius server. these nas's has dynamis ip's. has anybody an idea how i could deal with that. at the moment i have a client named 0.0.0.0/0 in the clients.conf file - but that means that every nas have the same shared secret. better ideas ? and could someone tell me if my suggestions about the shared secret are right. -> if using pap or chap shared secred is used to encrypt password when sending. -> if using peap or ttls shared secret is not used in the authentication process but for the sending of encryption key for further encryption of the connection between supplicant and radius at the end of the authentification session is that right ? greetings grischan -- 5 GB Mailbox, 50 FreeSMS http://www.gmx.net/de/go/promail +++ GMX - die erste Adresse f�r Mail, Message, More +++

2 1

RE: upgrading freeRADIUS
by DELORT Stephane 31 May '05

31 May '05

Hello Vicky, Haven't you try to copy your config files and do the upgrade on a test system ? (create an exact replica on another machine and upgrade it) I think it would be useful to post an "howto to upgrade from xxx to yyy" once you've done it. regards, Stéphane -----Message d'origine----- De : freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]De la part de vicky Envoyé : mardi 31 mai 2005 11:31 À : FreeRadius users mailing list Objet : upgrading freeRADIUS Hi list subscribers, hi list admins, (again) I'm running a freeRADIUS server version 0.8.1 (I know it is ancient) and I want to upgrade it to the latest version available. I have been trying to find some kind of procedure to upgrading but with no success. Does anyone know how to (in a fairly simple way) safely upgrade? The safetyness is very crucial, I cant risk overwriting my old configuration. The old server is built with #configure --prefix=/opt/freeradius #make #su #make install Thanks to you all in advance and please notice that I'm not that of an expert on RADIUS... Keep up the good work! -- Vicky - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

5 5

No detail logs # 2
by Radius 31 May '05

31 May '05

Everything was working fine until we switched back haul providers. We changed all the ip address's that we could fine under the raddb/etc directory. I'm sure I missed a setting or something. We changed providers as well as our IP address's 4 days ago. Ever Since we did, no detail logs are being created by FreeRadius 9.3 Everyone can get logged in and realms are working fine, just no detail log. Any Ideas? Thanks Bob Ross

4 6

Please resend this message to Kim Jones'
by Kim 31 May '05

31 May '05

Please resend this message to Kim Jones' new email address. Thank You. kim(a)omegatechinc.com

1 0

controlling the auth by CallingStationId
by Ernesto Freyre Ramírez 31 May '05

31 May '05

Dear Sirs, please , I hope someone here could to help me, I wish to control the authentication process by including a check of the CallingStationId parameter, being some generic features of it, or also all the value of the same, please some hint aboout where I must to configure this task? Thank you Ernesto Freyre Ramírez

2 1

Authenticate against Mac OS X Open Directory
by Ekkehard Burkon 31 May '05

31 May '05

Hi, did anyone successfully authenticate against a Mac OS X servers Open Directory? I need it for 802.1x/WPA. Are there any docs on the web? Thank you for any help. Ekkehard --

2 1

time request
by Thiago Felipe de Andrade 31 May '05

31 May '05

2 1

Filter
by José Berenguer 31 May '05

31 May '05

Hello, Anyone can tell me where can I find some instructions about how to configure the "filter=" option in the "module ldap" subsection of radiusd.conf? Thanks a lot! -- ********************************************************************** José Berenguer Giménez Área de Comunicaciones-Servicio de Informática UNIVERSIDAD DE ALMERÍA Crta. de Sacramento s/n, 04120 - Almería Tlf.: 950014014 E-mail: jose(a)ual.es **********************************************************************

2 1

Please resend this message to Kim Jones'
by Kim 31 May '05

31 May '05

Please resend this message to Kim Jones' new email address. Thank You. kim(a)omegatechinc.com

1 0

Please resend this message to Kim Jones'
by Kim 31 May '05

31 May '05

Please resend this message to Kim Jones' new email address. Thank You. kim(a)omegatechinc.com

1 0

Fw: Please resend this message to Kim Jones'
by Christopher Bootland 31 May '05

31 May '05

Thanks Jim, I've added the offender to my blocked sender list <plonk>. ;-) Chris ----- Original Message ----- From: "Jim Seymour" <jseymour(a)linxnet.com> To: <freeradius-users(a)lists.freeradius.org> Cc: <owner-freeradius-users(a)lists.freeradius.org> Sent: Tuesday, May 31, 2005 1:17 PM Subject: Re: Please resend this message to Kim Jones' > "Christopher Bootland" <bootland(a)cyberone.com.au> wrote: >> >> >> Why is Kim Jones at SimplyNet (?) harvesting addresses on this mailing >> list? >> I can't think of a valid reason why a third-party needs to know. Does >> anybody have any more information? > > Most likely what's happening is he, or whomever at his old email > address, is running lame email software that's auto-responding to > traffic from the mailing list. This is, more often than not, the fault > of Windows-based malware that doesn't know any better than to > auto-respond to "bulk" or "list" precedence messages, or to messages > not addressed directly to the recipient. The "X-Mailer: <SMTP32 > v8.05>" in his auto-responses suggests this is another such example. > > The list owner needs to manually remove "kim(a)simplynet.net" from the > mailing list. > > Jim > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > -- > This message has been scanned for viruses and > dangerous content by CyberOne E-Mail Spam and > Virus Protection Service, and is believed to > be clean from viruses. CyberOne accepts no > responsibility for the content of messages > in transit through our servers. > -- > Suspected unsolicited commercial bulk messages > (SPAM) have been marked with {Spam?} tag in > the subject line enabling you to filter them out > by using your mail software's filtering capabilities. >

1 0

Please resend this message to Kim Jones'
by Kim 31 May '05

31 May '05

Please resend this message to Kim Jones' new email address. Thank You. kim(a)omegatechinc.com

1 0

RE: ldap huntgroups and groups
by alan walters 31 May '05

31 May '05

Continuing with huntgroups and groups. I followed the most recent instructions below. The client uses the default group below. I see the reply message come through in the request But the request gets access accept instead of access reject????? > > ######################################################################## > # > ### default ldap group does not succeed > ######################################################################## > ## > > DEFAULT Auth-Type := Reject > Reply-Message = "sorry you are not allowed to dial in here" > The reply message should go on the second line on this one. Reply message is not a check item. Also, technically, you don't need Simultaneous User, since they are being rejected this session will never be added. Your user was found in a group, however, it should have been rejected since you have fall-though = 1 (yes). It should have fallen through to the default reject line. Note: This is probably not what you want, because all users will be rejected when you fix the Reject line. I would change Fall-Through = no (0), to all your Ldap-Group entries above it. Move the Reply-Message to the second line. DEFAULT Auth-Type := Reject Reply-Message = "You cannot dial in here"

1 0

upgrading freeRADIUS
by vicky 31 May '05

31 May '05

Hi list subscribers, hi list admins, (again) I'm running a freeRADIUS server version 0.8.1 (I know it is ancient) and I want to upgrade it to the latest version available. I have been trying to find some kind of procedure to upgrading but with no success. Does anyone know how to (in a fairly simple way) safely upgrade? The safetyness is very crucial, I cant risk overwriting my old configuration. The old server is built with #configure --prefix=/opt/freeradius #make #su #make install Thanks to you all in advance and please notice that I'm not that of an expert on RADIUS... Keep up the good work! -- Vicky

1 0