June 2005 - Freeradius-Users - lists.freeradius.org

Authenticate to eDirectory
by carnold5＠nc.rr.com 01 Jun '05

01 Jun '05

Hello all! I would like to know if anyone has gotten freeradius to work with eDirectory (LDAP)? We are using freeradius 0.93 (ships with sles9) and want our wireless users to authenticate to the eDirectory box. I changed the radiusd.config file at the ldap entry. Clients file has not been touched. It seems that i may need to "extend the schema" on the eDirectory box. Then include the supplied radiusxx.schema file in the slapd.conf file. Any help will be appreciated. Chris

3 2

[MSCHAP/PEAP/EAP-TLS] Default example certificate error
by Pete Flynt 01 Jun '05

01 Jun '05

Hi again, On my quest to get working FreeRadius with Active Directory, I am now stuck in the TLS section. Following some posts on the list ntlm_auth requires mschapv2 and mschapv2 requires peap which needs tls to work! So I tried this but without success. I'm using the default example certificates. It looks like the errors are in the source files. That's what I get when executing radiusd: tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "(null)" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "SecretKeyPass77" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" 4121:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:632:Expecting: CERTIFICATE 4121:error:0200100E:system library:fopen:Bad address:bss_file.c:259:fopen('','r') 4121:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:261: 4121:error:140AD002:SSL routines:SSL_CTX_use_certificate_file:system lib:ssl_rsa.c:513: rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls radiusd.conf[9]: eap: Module instantiation failed. What could be wrong? I just followed the description of the conf files and some hints on the list here. Regards, Pete _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar - get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/

2 1

Cannot find a configuration entry for module "exec"
by vicky 01 Jun '05

01 Jun '05

Hey people, I'm trying to upgrade my freeRADIUS server and to do so, I downloaded and installed the latest version available on freeradius.org. I installed and configured it in a separate folder than the "old" server is configured in. Today I stopped the "old" server and brought up the new one with radiusd -X and it gave me an error as shown below. . . . main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /opt/freeradiusupgrade/lib ERROR: Cannot find a configuration entry for module "exec". zsh: exit 1 /opt/freeradiusupgrade/sbin/radiusd -X With no line number or file name I don't even know where to begin to look. Does anyone has any suggestions? Every so thankful! -- Vicky

2 1

Multiple accounting hosts
by Ramm-Ericsson, Johannes 01 Jun '05

01 Jun '05

Hello! I have been searching for a way to send radius accounting information to multiple accounting hosts. I have been unable to get this working using proxy realms. I have also searched the mail archives and not come up with any solution. Has anyone been able to configure freeradius in this way, and if so, is it possible for you to share this information? Best Regards, Johannes R-E

2 1

Re: Forwarding
by Maxim Hitrov 01 Jun '05

01 Jun '05

Hello Alan Thanks for you replay. I have configured freeradius to make preproxing. But i have another problem: The "Reply-Message" didn't reach the application wich have been made auth request. Ready to process requests. rad_recv: Access-Request packet from host 11.0.0.2:3187, id=30, length=44 User-Name = "igor" User-Password = "\330\014\257}" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/11.0.0.2/auth-detail-20050601' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/11.0.0.2/auth-detail-20050601 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "igor", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "igor" rlm_realm: Proxying request from user igor to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" modcall[authorize]: module "suffix" returns updated for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 Processing the pre-proxy section of radiusd.conf modcall: entering group pre-proxy for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/11.0.0.2/pre-proxy-detail-20050601' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/11.0.0.2/pre-proxy-detail-20050601 modcall[pre-proxy]: module "pre_proxy_log" returns ok for request 0 preproxy_users: Matched entry DEFAULT at line 17 radius_xlat: '' modcall[pre-proxy]: module "files" returns ok for request 0 modcall: group pre-proxy returns ok for request 0 Sending Access-Request of id 0 to 11.0.0.5:1812 User-Name = "igor" User-Password = "\330\014\257}" NAS-IP-Address = 11.0.0.2 Proxy-State = 0x3330 Calling-Station-Id := "" --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Reject packet from host 11.0.0.5:1812, id=0, length=43 Reply-Message = "Authorization failed." Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/11.0.0.2/post-proxy-detail-20050601' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/11.0.0.2/post-proxy-detail-20050601 modcall[post-proxy]: module "post_proxy_log" returns ok for request 0 modcall[post-proxy]: module "eap" returns noop for request 0 modcall: group post-proxy returns ok for request 0 Login incorrect (Home Server says so): [igor/\330\014\257}] (from client test port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 11.0.0.2:3187, id=30, length=44 Sending Access-Reject of id 30 to 11.0.0.2:3187 Reply-Message = "Authorization failed." --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 30 with timestamp 429db3c5 Nothing to do. Sleeping until we see a request. So, it receives replay only on sencond request. Application failed on the first request timeout. What to do? Thank you Alan DeKok <aland(a)ox.org> wrote: Maxim Hitrov wrote: > Can i use FreeRadius as intermadiate Radius that will change and forward Access-Requests params? Yes. You should be able to do this using the "preproxy_users" file: DEFAULT Calling-Station-Id = "%{Framed-IP-Address}" Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Proxying without a realm
by Jeff Fern 01 Jun '05

01 Jun '05

Hello all, I have got an Airespace wireless lan system that allows multiple WLANs to be created and appear as completely seperate networks. The system allows radius authentication via multiple servers, but it does not allow specifying certain WLANs to certain servers. To determin which WLAN has been connected to, airespace passes an attribute along with the username (MAC Address), it does not pass any realm information. Does anyone know if it is possible to configure freeradius to proxy out all incoming radius requests but convert the attribute to an actual realm? To provide a bit more background detail, we have a Tatara AAA system which is connected to a HLR (the HLR actually does the authentication, Tatara just acts as a proxy to it). I need to create two seperate WLANs which, when presented to Tatara for authentication, one will appear as a home connection and the other as a roaming connection - hence the need for specific realms. Freeradius would be proxying all requests to the same Tatara system (but needs to add realm information). Any help or advise would be gratefully recieved. Regards, -Jeff Fern

2 1

How to authenticate users against a Windoze AD server with krb5?
by Arne Götje (高盛華) 01 Jun '05

01 Jun '05

Hi list, I'm trying to authenticate users against a Windows AD server using the krb5 module... but due to missing documentation on how to do this, I'm stuck. When I try to get a Kerberos ticket using kinit on the radius machine, it works. But when I try to use the krb5 module, it always gives me a Reject... Is there anywhere a detailed howto available? Google didn't help me much... :( Cheers Arne -- Arne Götje (高盛華) <arne(a)linux.org.tw> PGP/GnuPG key: 1024D/685D1E8C Fingerprint: 2056 F6B7 DEA8 B478 311F 1C34 6E9F D06E 685D 1E8C Key available at wwwkeys.pgp.net. Encrypted e-mail preferred.

3 4

Re: help for using eap and TTLS
by Maurice.Bourguel 01 Jun '05

01 Jun '05

Hello, Thanks for your advice. Effectively I'd upgraded to "tiger". After deleting the old certifcate (server and certification authority) everything works fine. bets regards Maurice certificate > Subject: Re: help for using eap and TTLS > X-BeenThere: freeradius-users(a)lists.freeradius.org > X-Mailman-Version: 2.1.5 > List-Id: FreeRadius users mailing list <freeradius-users.lists.freeradius.org> > List-Unsubscribe: <http://lists.freeradius.org/mailman/listinfo/freeradius-users>, <mailto:freeradius-users-request@lists.freeradius.org?subject=unsubscribe> > List-Archive: <https://list.xs4all.nl/pipermail/freeradius-users> > List-Post: <mailto:freeradius-users@lists.freeradius.org> > List-Help: <mailto:freeradius-users-request@lists.freeradius.org?subject=help> > List-Subscribe: <http://lists.freeradius.org/mailman/listinfo/freeradius-users>, <mailto:freeradius-users-request@lists.freeradius.org?subject=subscribe> > X-Mailman-Copy: yes > > We are doing EAP-TTLS/PAP and have seen this on two different occasions. > > We were having this problem with our OSX machines that had upgraded to > Tiger. Something seems to get messed up with the certs during the > upgrade. Once we cleared the CA, and server certs everything worked > fine. > > All of our windows machines running the SecureW2 client were initially > having this problem. There is a setting under the advanced config in > the client that says to renew DHCP after connecting. Once we did that > we were fine. > > - Joe > > > *********************************************************** > > * e-mail : bourguel(a)cirm.univ-mrs.fr * > > ---------------------------------------------------------- > > * Maurice Bourguel + * > > * CIRM - MENRT-CNRS-SMF + * > > * case 916, 163 Avenue de Luminy + tel (33) 04 91 83 30 23* > > * 13288 Marseille Cedex 9 + fax (33) 04 91 83 30 05* > > *********************************************************** > > *http://www.cirm.univ-mrs.fr * > > *********************************************************** > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html *********************************************************** * e-mail : bourguel(a)cirm.univ-mrs.fr * ---------------------------------------------------------- * Maurice Bourguel + * * CIRM - MENRT-CNRS-SMF + * * case 916, 163 Avenue de Luminy + tel (33) 04 91 83 30 23* * 13288 Marseille Cedex 9 + fax (33) 04 91 83 30 05* *********************************************************** *http://www.cirm.univ-mrs.fr * ***********************************************************

1 0

Authenticating... disconnect and reauthentication fails.. :( Why?
by Jean-Sébastien Nicaise 01 Jun '05

01 Jun '05

here are my results: just rebooted and the radiusd is running and taking requests..... then I connect with my windows xp to my AP wich redirects to my radius server. First it authenticates then connect. But I CAN'T access internet. About 4-5 seconds later it disconnects, then tries to re-authenticate. Re-authentication fails and crashes my AP. first connect: ------------------- Wed Jun 1 12:35:51 2005 : Info: rlm_eap_tls: Length Included Wed Jun 1 12:35:51 2005 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Jun 1 12:35:51 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Wed Jun 1 12:35:51 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Wed Jun 1 12:35:51 2005 : Info: rlm_eap_tls: Length Included Wed Jun 1 12:35:51 2005 : Info: (other): SSL negotiation finished successfully Wed Jun 1 12:35:51 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Wed Jun 1 12:35:51 2005 : Auth: Login OK: [client/<no User-Password attribute>] (from client radius-network port 1 cli 00-0C-E5-46-8A-49) ----------------------------------- (can't connect to internet) then 4-5 seconds later: --------------------------------- Wed Jun 1 12:35:58 2005 : Info: rlm_eap_tls: Length Included Wed Jun 1 12:35:58 2005 : Error: TLS_accept:error in SSLv3 read client certificate A Wed Jun 1 12:35:58 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message Wed Jun 1 12:35:58 2005 : Info: rlm_eap_tls: Received EAP-TLS ACK message [radius@poste2 ~]$ ------------------------------------ crashes my AP and can't connect anymore. any ideas? thanks, Jean-Sébastien Nicaise

1 0

Re: help for using eap and TTLS
by Maurice.Bourguel 01 Jun '05

01 Jun '05

Hi, Thanks to David for you answer; Changing tls by ttls in the eap module don't change the rlm_eap message: rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned If I change tls par ttls in the tls module the mac OSX ask for accepting certificate and I obtain: client connected via TTLS in the 802.1X logging window. But I don't connect to my network. I don't understand what happens now. If I configure the en1 interface by hand (ifconfig en1 .., route add default .) I can connect. Does this problem know of anyone ? regards Maurice ---------------------- The used eap.conf file: ----------------------- eap { # MB tls default_eap_type = md5 default_eap_type = tls timer_expire = 60 # MB yes ignore_unknown_eap_types = no ignore_unknown_eap_types = yes cisco_accounting_username_bug = no #MD5# md5 { } # Cisco LEAP leap { } gtc { auth_type = PAP } ## EAP-TLS # decommente MB tls { # changing tls by ttls to obtain freeradisu to work default_eap_type = ttls # CA_path=${raddbdir}/certs private_key_password = whatever private_key_file=${raddbdir}/certs/euler.univ-mrs.fr.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. certificate_file=${raddbdir}/certs/euler.univ-mrs.fr.pem # Trusted Root CA list CA_file = ${raddbdir}/certs/root.pem # CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random # MB 1750 fragment_size = 1024 fragment_size = 1750 include_length = yes check_crl = yes } ttls { # default_eap_type = md5 # # allowed values: {no, yes} copy_request_to_tunnel = yes # MB yes # allowed values: {no, yes} use_tunneled_reply = yesa # MB yes } The radiusd debugging output ----------------------------- auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 26 HASH: user mbourguel found in hashtable bucket 32912 modcall[authenticate]: module "unix" returns ok for request 26 modcall: group authenticate returns ok for request 26 Login OK: [mbourguel/XXXXX] (from client localhost port 265 cli 0011.2420.94f9) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 26 radius_xlat: '/var/log/radius/radacct/localhost/reply-detail-20050601' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/localhost/reply-detail-20050601 modcall[post-auth]: module "reply_log" returns ok for request 26 modcall: group post-auth returns ok for request 26 TTLS: Got tunneled Access-Accept rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 26 modcall: group authenticate returns ok for request 26 Login OK: [mbourguel/<no User-Password attribute>] (from client Radius port 265 cli 0011.2420.94f9) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 26 radius_xlat: '/var/log/radius/radacct/Wf-bast5/reply-detail-20050601' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/Wf-bast5/reply-detail-20050601 modcall[post-auth]: module "reply_log" returns ok for request 26 modcall: group post-auth returns ok for request 26 Sending Access-Accept of id 46 to 139.124.3.235:21645 Framed-MTU = 576 Service-Type = Framed-User Framed-MTU = 576 Service-Type = Framed-User MS-MPPE-Recv-Key = 0x6eb67fa031a685d0f892bf8c7d9e03a08f177601494b571538707de605d56af4 MS-MPPE-Send-Key = 0x8899e08fbcfb4523c7c0eb7d734df9973e032b78cb594a7c2d405d5bcba45438 EAP-Message = 0x03050004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "mbourguel" Finished request 26 Going to the next request --- Walking the entire request list --- Waking up in 2 seconds... rad_recv: Accounting-Request packet from host 139.124.3.235:21645, id=47, length=210 Acct-Session-Id = "0000000C" Called-Station-Id = "0012.dacb.b0c0" Calling-Station-Id = "0011.2420.94f9" Cisco-AVPair = "ssid=tsunami" Cisco-AVPair = "nas-location=unspecified" Cisco-AVPair = "connect-progress=Call Up" Acct-Authentic = RADIUS User-Name = "mbourguel" Acct-Status-Type = Start NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "265" NAS-Port = 265 Service-Type = Framed-User NAS-IP-Address = 139.124.3.235 Acct-Delay-Time = 0 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 27 modcall[preacct]: module "preprocess" returns noop for request 27 rlm_acct_unique: Hashing 'NAS-Port = 265,Client-IP-Address = Wf-bast5,NAS-IP-Address = 139.124.3.235,Acct-Session-Id = "0000000C",User-Name = "mbourguel"' rlm_acct_unique: Acct-Unique-Session-ID = "5c292ba8903fd30c". modcall[preacct]: module "acct_unique" returns ok for request 27 rlm_realm: No '@' in User-Name = "mbourguel", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 27 modcall[preacct]: module "files" returns noop for request 27 modcall: group preacct returns ok for request 27 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 27 radius_xlat: '/var/log/radius/radacct/Wf-bast5/detail-20050601' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/Wf-bast5/detail-20050601 modcall[accounting]: module "detail" returns ok for request 27 radius_xlat: '/var/log/radius/radutmp' radius_xlat: 'mbourguel' modcall[accounting]: module "radutmp" returns ok for request 27 modcall: group accounting returns ok for request 27 Sending Accounting-Response of id 47 to 139.124.3.235:21645 Finished request 27 Going to the next request Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 22 ID 42 with timestamp 429dc9aa Cleaning up request 23 ID 43 with timestamp 429dc9aa Cleaning up request 24 ID 44 with timestamp 429dc9aa Cleaning up request 25 ID 45 with timestamp 429dc9aa Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 26 ID 46 with timestamp 429dc9ae Cleaning up request 27 ID 47 with timestamp 429dc9ae Nothing to do. Sleeping until we see a request. Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 26 HASH: user mbourguel found in hashtable bucket 32912 modcall[authenticate]: module "unix" returns ok for request 26 modcall: group authenticate returns ok for request 26 Login OK: [mbourguel/XXXXXX] (from client localhost port 265 cli 0011.2420.94f9) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 26 radius_xlat: '/var/log/radius/radacct/localhost/reply-detail-20050601' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/localhost/reply-detail-20050601 modcall[post-auth]: module "reply_log" returns ok for request 26 modcall: group post-auth returns ok for request 26 TTLS: Got tunneled Access-Accept rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 26 modcall: group authenticate returns ok for request 26 Login OK: [mbourguel/<no User-Password attribute>] (from client Radius port 265 cli 0011.2420.94f9) *********************************************************** * e-mail : bourguel(a)cirm.univ-mrs.fr * ---------------------------------------------------------- * Maurice Bourguel + * * CIRM - MENRT-CNRS-SMF + * * case 916, 163 Avenue de Luminy + tel (33) 04 91 83 30 23* * 13288 Marseille Cedex 9 + fax (33) 04 91 83 30 05* *********************************************************** *http://www.cirm.univ-mrs.fr * ***********************************************************

2 1