September 2005 - Freeradius-Users - lists.freeradius.org

Question on certs with FreeRadius/Openssl
by john＠jetcityorange.com 11 Sep '05

11 Sep '05

Hello, I’m not sure if this is the right forum for this but I thought I’d ask to see if anyone has ideas or input. Please forgive me if this isn’t the right forum. We have a Fedora Core 1 box running FreeRadius 1.0.4 and OpenSSL-0.9.7g. We would like to set up EAP/TLS. Everything runs fine, the root cert creates fine, so does the client cert but the server cert does not create. I get the following error: ERROR: adding extensions in section xpserver_ext 5212:error:2207C082:X509 V3 routines:DO_EXT_CONF:unknown extension name:v3_conf.c:123: 5212:error:2206B080:X509 V3 routines:X509V3_EXT_conf:error in extension:v3_conf.c:92:name=extendedKeyUsager, value=1.3.6.1.5.5.7.3.1 No certificate matches private key 5214:error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long:asn1_lib.c:140: unable to load certificate 5215:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:637:Expecting: TRUSTED CERTIFICATE I have combed the FAQ, along with multiple sites and pulled down the EAPTLS-FreeRadius doc to no avail. I’ve verified my openssl.cnf and CA files carefully. The xpextensions file is located in the same directory as my openssl.cnf file. My question is what have I missed? Is there some FreeRadius or OpenSSL config that I’m missing? Thanks very much, John

1 0

seeing "Error: rlm_sql: Stop packet with zero session length"
by Ilia Chipitsine 11 Sep '05

11 Sep '05

Dear Sirs, we are running freeradius for VoIP accounting for Cisco AS5350 I see many-many records like Error: rlm_sql: Stop packet with zero session length. (user 'XXX', nas 'YYY') in radius.log I'm told that there's no error at Cisco, and that situation happens when callee doesn't accept call, that's why session length is equal to zero. Can status of that situation be reconsidered to "no error" ? I really don't want seeing the same message thousand times. Cheers, Ilia Chipitsine

1 0

pppoe+radius
by Wassim abbas 11 Sep '05

11 Sep '05

Hello I want to use freeradius with pppoe-server both runing on the same machine but i cant get radius working i loaded the radius.so in the pppoe-option file but it says raidus is not responding and timed out so please if any one have done it before and can send me the config file, im using the user files without mysql thanks -- Slackware Inside

2 1

RE: mysql connections - segmentation fault
by Jonathan De Graeve 11 Sep '05

11 Sep '05

Have freeradius running on Debian 3.0 and Debian 3.1 without any problems. J. -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Andreas M. Verzonden: zondag 11 september 2005 10:54 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: mysql connections - segmentation fault Hello, i´ve installed FR 1.0.4, now when i start the server, during the connection to a mysql database, after the first one there is a segmentation fault. It is working with just one connection , but i can´t find the reason for this. Maybe it has already been reported, i found similar in the internet, but no solution. I´m running FR on a Debian 3.01 machine. Thanks for all, Andreas M - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

How to add sub-attributes in a dictionary file?
by Toyoda 09 Sep '05

09 Sep '05

---------- Forwarded message ---------- Hello, Could you let me know how to add a sub-attributes in a dictionary file? For example, there is an attribute DIGEST_ATTRIBUTE = 207 and its sub-attribute SIP_URI = 4. How can I define this sub-attribute to the dictionary file? I'd appreciate your help. J Toyoda

2 1

rlm_perl / rlm_python
by ricklim＠telus.net 09 Sep '05

09 Sep '05

Hi there, Could someone tell me what versions of freeradius have rlm_perl? I have a fedora box with freeradius 1.0.1 installed, I have downloaded the 1.0.4 version and it has references to rlm_perl in it. Do I have to install the 1.0.4 version to get rlm_perl? A very subjective question here... what is better to use rlm_perl or rlm_python? I would have to learn python, but if the general concensus is to go with python I'll do it. TIA

2 2

RE: rlm_perl / rlm_python
by Jonathan De Graeve 09 Sep '05

09 Sep '05

I think there's a bug in the latest perl versions. When you are running Debian 3.1 (perl 5.8.4) and want experimental package you may want to link libperl.so into freeradius, if you don't you get an error when you start the freeradius server with rlm_perl enabled Like: /usr/sbin/freeradius: relocation error: /usr/lib/perl/5.8/auto/IO/IO.so: undefined symbol: Perl_Tstack_sp_ptr (failed! run '/usr/sbin/freeradius -x' to find out why.) I solved this with recompile configure option: --with-rlm-perl-lib-dir=/usr/lib/libperl.so.5.8.4 You also can do LD_PRELOAD=/usr/lib/libperl.so freeradius but I would suggest the first option... J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Thor Spruyt Verzonden: vrijdag 9 september 2005 23:19 Aan: FreeRadius users mailing list Onderwerp: Re: rlm_perl / rlm_python ricklim(a)telus.net wrote: > Hi there, > Could someone tell me what versions of freeradius have rlm_perl? All latest version have it. But it's unstable and therefore you have to compile from source using --with-experimental-modules > Do I have to install the 1.0.4 version to get rlm_perl? No, but latest version is best :) > A very subjective question here... what is better to use rlm_perl or > rlm_python? I think that rlm_perl is likely to be supported better than rlm_python. > I would have to learn python, but if the general concensus is to go > with python I'll do it. Go for rlm_perl -- Groeten, Regards, Salutations, Thor Spruyt M: +32 (0)475 67 22 65 E: thor.spruyt(a)telenet.be W: www.thor-spruyt.com www.salesguide.be www.telenethotspot.be - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

how to add a sub-attributes in a dictionary
by Toyoda 09 Sep '05

09 Sep '05

Hello, I would like to know how to add a sub-attributes in a dictionary file? For example, there is an attribute DIGEST_ATTRIBUTE = 207 and its sub-attribute SIP_URI = 4. How can I define this sub-attribute to the dictionary file? I'd appreciate your help. J Toyoda

1 0

Re: Windows Client Authentification bevore Domain logon
by Armin Krämer 09 Sep '05

09 Sep '05

Ok, the hole day i tried to get it to work but this time when i install the certificate as a machine zertifikate the radius authentifikation log ends up with this log below. The Certificates where generated with openssl and all works fine as User certificates but not as computer zertificate. I set the Registry Patch which was diescribed in the mailing list to a value of 2. If anyone konws why this doesnt work please mail me. rad_recv: Access-Request packet from host 10.40.0.254:1024, id=125, length=120 NAS-IP-Address = 10.40.0.254 NAS-Port-Type = Ethernet Service-Type = Framed-User Message-Authenticator = 0x75b32a36b118137416c352ac114ec00c NAS-Port = 8 Framed-MTU = 1490 User-Name = "host/Client5" Calling-Station-Id = "00-10-5A-F7-F0-BA" EAP-Message = 0x02ff001101686f73742f436c69656e7435 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "host/Client5", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 255 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 181 users: Matched entry DEFAULT at line 200 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 125 to 10.40.0.254:1024 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010000060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3409168c713d79e19e09bf2f2ab092c9 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 125 with timestamp 430c8459 Nothing to do. Sleeping until we see a request. FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> schrieb am 24.08.05 09:52:57: At 12:49 23/08/05, you wrote: >Hi, thanks for your email! > >Ok, i tried it out but i have some problems. If i use the DWORT String you >sent me it has no efekkt. I found an other DWORT Key which Sounds >"AuthMode" and with this DWORT he only tries to authentificate with the >machine account. Maybe you have made a typing mistake in your email?? Whoops - You are right it was a typing mistake, it is AuthMode. >Ok, but my problem ist, that when he tries to authentificate with the >Computer Account i see in the radius debugging modse that he only tried to >use the default entry in the user File and not the "Client3" Entry. It >seems that he does not find the right Computer Certificate or the >Freeradius does not find the Right Entry in his user File??? I am new to freeRADIUS myself in order to get my system working I followed the instructions in these web pages, http://www.linuxjournal.com/article/8017, http://www.linuxjournal.com/article/8095, http://www.linuxjournal.com/article/8151. It does look like a certificates problem, but then I am very new to FreeRADIUS and I spent a considerable amount of time adjusting settings to make it work. >This is the output from Freeradius -X -A when the DWORT "AuthMode" is set >to 2 > > > >Starting - reading configuration files ... >reread_config: reading radiusd.conf >Config: including file! : /etc/freeradius/proxy.conf >Config: including file: /etc/freeradius/clients.conf >Config: including file: /etc/freeradius/snmp.conf >Config: including file: /etc/freeradius/eap.conf >Config: including file: /etc/freeradius/sql.conf > main: prefix = "/usr" > main: localstatedir = "/var" > main: logdir = "/var/log/freeradius" > main: libdir = "/usr/lib/freeradius" > main: radacctdir = "/var/log/freeradius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/var/log/freeradius/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/var/! run/freeradius/freeradius.pid" > main: user = "freerad" >&nbs >p;main: group = "freerad" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = yes > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 >read_config_files: reading dictionary >read_config_files: reading naslist >Using deprecated naslist file. Support for this will go away soon. >read_config_files: reading clients >read_config_files: reading realms >radiusd: entering modules setup >Module: Library ! search path is /usr/lib/freeradius >Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" >rlm_exec: Wait=yes but no output defined. Did you mean output=none? >Module: Instantiated exec (exec) >Module: Loaded expr >Module: Instantiated expr (expr) >Module: Loaded PAP > pap: encryption_scheme = "crypt" >Module: Instantiated pap (pap) >Module: Loaded CHAP >Module: Instantiated chap (chap) >Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > mschap: ntlm_auth = "(null)" >Module: Instantiated mschap (mschap) >Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > ! ;unix: shadow = "/etc/shadow" > unix: group = "(null)" > ;unix: radwtmp = "/var/log/freeradius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 >Module: Instantiated unix (unix) >Module: Loaded eap > eap: default_eap_type = "tls" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no >rlm_eap: Loaded and initialized type md5 >rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" >rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/etc/ssl/certs/8021x-server.pem" > tls: certificate_file = "/etc/ssl/certs/8021x-server.pem" > tls: CA_file = "/etc/ssl/certs/root.pem" > tls: private_key_pa! ssword = "whatever" > tls: dh_file = "/etc/ssl/certs/dh" > tls: random_file = "/etc/ssl/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = no > tls: check_cert_cn = "(null)" >rlm_eap: Loaded and initialized type tls > mschapv2: with_ntdomain_hack = no >rlm_eap: Loaded and initialized type mschapv2 >Module: Instantiated eap (eap) >Module: Loaded preprocess > preprocess: huntgroups = "/etc/freeradius/huntgroups" > preprocess: hints = "/etc/freeradius/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no >Module: Instantiated preprocess (preprocess) >Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no realm: ignore_null = no >Module: Instantiated realm (suffix ) >Module: Loaded files > files: usersfile = "/etc/freeradius/users" > files: acctusersfile = "/etc/freeradius/acct_users" > files: preproxy_usersfile = "/etc/freeradius/preproxy_users" > files: compat = "no" >Module: Instantiated files (files) >Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" >Module: Instantiated acct_unique (acct_unique) >Module: Loaded detail > detail: detailfile = > "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no >Module: Instantiated detail (detail) >Module: Loaded radutmp > radutmp: filename = "/var/log/freeradius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: ca! llerid = yes >Module: Instantiated radutmp (radutmp) >Listening on authentication *:1812 >Listening on accounting *:1813 >Listening on proxy *:1814 >Ready to process requests. >rad_recv: Access-Request packet from host 10.40.0.254:1024, id=103, length=120 > NAS-IP-Address = 10.40.0.254 > NAS-Port-Type = Ethernet > Service-Type = Framed-User > Message-Authenticator = 0x8e013b02cf39c8b291f8a9d790f3bd6a > NAS-Port = 8 > Framed-MTU = 1490 > User-Name = "host/Client3" > Calling-Station-Id = "00-10-5A-F7-F0-BA" > EAP-Message = 0x02ff001101686f73742f436c69656e7433 > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > &nbs! >p; rlm_realm: No <mailto:'@'>'@' in User-Name = "host/Cli ent3", looking >up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: EAP packet type response id 255 length 17 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 0 > users: Matched entry DEFAULT at line 181 > users: Matched entry DEFAULT at line 200 > modcall[authorize]: module "files" returns ok for request 0 >modcall: group authorize returns updated for request 0 > rad_check_password: Found Auth-Type EAP >auth: type "EAP" > Processing the authenticate section of radiusd.conf >modcall: entering group authenticate for request 0 > rlm_eap: EAP Identity > rlm_eap: processing type tls > rlm_eap_tls: Requiring client certificate > rlm_eap_tls: Initiate > rlm_eap_tls: ! Start returned 1 > modcall[authenticate]: module "eap" returns handled for request 0 >modcall: group authenticate returns handled for request 0 >Sending Access-Challenge of id 103 to 10.40.0.254:1024 > Framed-IP-Address = 255.255.255.254 > Framed-MTU = 576 > Service-Type = Framed-User > EAP-Message = 0x010000060d20 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x1814a65439afaa74487aa379af48ead9 >Finished request 0 >Going to the next request >--- Walking the entire request list --- >Waking up in 6 seconds... >--- Walking the entire request list --- >Cleaning up request 0 ID 103 with timestamp 430b0c7e >Nothing to do. Sleeping until we see a request. >rad_recv: Access-Request packet from host 10.40.0.254:1024, id=104, length=120 > NAS-IP-Address = 10.40.0.254 > NAS-Port-Type = Ethernet > Service-Type = Framed-User > Message-Authenticator = 0xe3868d2! de84c592e7e54eb355b23752f > NAS-Port = 8 > Framed-MTU = 1490 > User-Name = "host/Client3" > Calling-Station-Id = "00-10-5A-F7-F0-BA" > EAP-Message = 0x0201001101686f73742f436c69656e7433 > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 1 > modcall[authorize]: module "preprocess" returns ok for request 1 > modcall[authorize]: module "chap" returns noop for request 1 > modcall[authorize]: module "mschap" returns noop for request 1 > rlm_realm: No <mailto:'@'>'@' in User-Name = "host/Client3", looking > up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 1 > rlm_eap: EAP packet type response id 1 length 17 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 1 > users: Matched entry DEFAULT at li! ne 181 > users: Matched entry DEFAULT at line 200 > modcall[authorize]: module "files" returns ok for request 1 >modcall: group authorize returns updated for request 1 > rad_check_password: Found Auth-Type EAP >auth: type "EAP" > Processing the authenticate section of radiusd.conf >modcall: entering group authenticate for request 1 > > Fallibroome High School Priory Lane Macclesfield Cheshire SK10 4AF - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

8 15

Ascend-Data-Filter replies sent, but something amiss
by Justin M. Parker 09 Sep '05

09 Sep '05

Greetings. I've got freeradius (radiusd: FreeRADIUS Version 1.0.2, for host , built on Sep 7 2005 at 14:10:37) running, and authenticating well. My user names, passwords, and nas's are stored in a MySQL database. I have a user of name, say, "justin" belonging to group "dialin". The radgroupreply table has four rows of data like this: id GroupName Attribute op Value prio 1 dialin Ascend-Data-Filter += ip in forward est 0 2 dialin Ascend-Data-Filter += ip in forward dst ip x.x.x.x/32 0 3 dialin Ascend-Data-Filter += ip in drop tcp dstport = 25 0 4 dialin Ascend-Data-Filter += ip in forward 0 Here's what wvdial does with the Ascend-Data-Filters in place: --> WvDial: Internet dialer version 1.54.0 --> Initializing modem. --> Sending: ATZ ATZ OK --> Sending: ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0 W2 ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0 W2 OK --> Modem initialized. --> Sending: ATDT<number> --> Waiting for carrier. ATDT<number> CONNECT 50666 --> Carrier detected. Waiting for prompt. <login prompt> --> Looks like a login prompt. --> Sending: <login@realm> Password: --> Looks like a password prompt. --> Sending: (password) Remote Authentication server timeout. <login prompt> --> Looks like a login prompt. --> Sending: <login@realm> Password: --> Looks like a password prompt. --> Sending: (password) ** Bad Password <login prompt> --> Looks like a login prompt. --> Sending: <login@realm> --> Don't know what to do! Starting pppd and hoping for the best. --> Starting pppd at Fri Sep 9 12:45:58 2005 --> pid of pppd: 11381 --> Using interface ppp0 --> Disconnecting at Fri Sep 9 12:46:02 2005 --> The PPP daemon has died: Authentication error. --> We failed to authenticate ourselves to the peer. --> Maybe bad account or password? (exit code = 19) --> man pppd explains pppd error codes in more detail. --> I guess that's it for now, exiting --> The PPP daemon has died. (exit code = 19) There's an awful lot of output from radius -X running while I attempt to auth, but here's something that sticks out: rlm_sql (sql): Released sql socket id: 5 modcall[post-auth]: module "sql" returns ok for request 1 modcall: group post-auth returns ok for request 1 Sending Access-Accept of id 67 to <ip:port> Ascend-Data-Filter += 0x697020696e20666f72776172642074637020657374 Ascend-Data-Filter += 0x697020696e20666f7277617264206473746970203230382e31322e3136352e302f3234 Ascend-Data-Filter += 0x697020696e2064726f702074637020647374706f7274203d203235 Ascend-Data-Filter += 0x697020696e20666f7277617264 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 67 with timestamp 4321cf66 Nothing to do. Sleeping until we see a request. As far as radiusd knows, I logged in. Removing my user from that dialin group (and thus not sending the group's replies) allows me to login as usual. Any ideas? Do those filter replies look right? they almost look like hex to me, not binary. I've tried X-Ascend-Data-Filter and Ascend-Data-Filter. Changing the op to := sends only the first of the four replies. In the attrs file, I've added the below line to my DEFAULT set: Ascend-Data-Filter =* ANY Any replies appreciated. -justin

1 1