September 2005 - Freeradius-Users - lists.freeradius.org

RE: EAP-TLS reject if CN not in MySQL
by Jonathan De Graeve 28 Sep '05

28 Sep '05

In Doc: imply a group that changes the default ACTIONs to something like fail = 1 everythingelse = return Tried in config: everythingelse = return radiusd.conf[1637] Unknown module rcode 'everythingelse'. Also tried: everything_else = return radiusd.conf[1637] Unknown module rcode 'everything_else'. Any ideas? -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Ben Dowling Verzonden: dinsdag 27 september 2005 22:42 Aan: FreeRadius users mailing list Onderwerp: Re: EAP-TLS reject if CN not in MySQL Brilliant, that does the trick. Thanks a lot, Ben On Tue, 2005-09-27 at 16:05 -0400, Alan DeKok wrote: > Ben Dowling <bendowling(a)lineone.net> wrote: > > Sorry I was referring to the username, the CN in the certificate gets > > sent as the username. My problem is how to reject users with valid > > certificates, but no entry in the database? > > doc/configurable_failover > > configure a module "always reject" (see radiusd.conf) > > In "authorize", do: > > ... > group { > sql { > notfound = 1 > ok = return > fail = return > everything_else = return > } > reject > } > > That says "if the user isn't found in SQL, reject" > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Expose RADIUS packet's identifier
by Josh Howlett 28 Sep '05

28 Sep '05

Hi, Does anyone know if the server can expose a RADIUS packet's identifier, for example through mod_exec? Or, is this limited to RADIUS attributes only? thanks, josh.

2 1

AccountingReq message authenticator
by Ashwin Gobind 28 Sep '05

28 Sep '05

Hi. Is there anyway to generate a message authenticator for an accounting request packet. At the moment I am using JRadius, I need to send an accounting request message to another radius server. However after I add the message authenticator and send to to another server, the other server complains about "Invalid message authenticator" (Shared secret is incorrect). Here is some code : //Proxy request to the wap gateway DatagramSocket socket = new DatagramSocket(); socket.setSoTimeout(5000); //Generate authenticator MessageDigest md5 = MessageDigest.getInstance("MD5"); md5.reset(); md5.update((byte)req.getCode()); md5.update((byte)req.getIdentifier()); int length = req.getBytes().length; byte [] authenticator = req.getAuthenticator(); byte [] attributeBytes = req.getAttributeBytes(req.getAttributes(),0); for (int z=0; z <authenticator.length ; z++ ) RadiusLog.debug("Autenticator["+z+"] Before = " + authenticator[z]); RadiusLog.debug("Autenticator Length: " + authenticator.length); RadiusLog.debug("Attributes Length: " + attributeBytes.length); RadiusLog.debug("Paket Length: " + length); String sharedSecret = "testing123"; md5.update((byte)(length >> 8)); md5.update((byte)(length & 0xff)); md5.update(authenticator, 0, authenticator.length); md5.update(attributeBytes, 0, attributeBytes.length); md5.update(sharedSecret.getBytes()); req.overwriteAttribute(AttributeFactory.newAttribute(AttributeDictionary .MESSAGE_AUTHENTICATOR, authenticator)); System.arraycopy(md5.digest(), 0, authenticator, 0, 16); �This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.net/legal/email.aspx "

3 2

rlm_perl
by ricklim＠telus.net 28 Sep '05

28 Sep '05

Could someone show me how to process an access-accept via rlm_perl? The example in the script example.pl still causes an access-reject nomater what I try. Thanks.

2 1

Re: How to run CA.all script to generate EAP-TLS certifiate
by Daniel Hesse 28 Sep '05

28 Sep '05

This helped me a lot!!!! The 2nd link deals with certificates! http://interactive.linuxjournal.com/node/8017/print http://www.linuxjournal.com/node/8095/print http://www.linuxjournal.com/article/8151 Daniel D. Hesse Technology Administrator Methodist Manor Retirement Community 712-732-1120 Ext.116 dhesse(a)mmrcsl.org

1 0

Monitoring FreeRadius with WhatsUp! Professional
by Matthew Anderson 28 Sep '05

28 Sep '05

Are there any freeradius users out there that are using WhatsUp! to monitor there freeradius server? I am trying to set it up but I am unsure what to use for the send/expect statements. Any help would be greatly appreciated. I already configured WhatsUp! to use port 1812 and was told by the WhatsUp! People to contact the vendor for freeradius to get the correct Send/expect strings. Thanks! Matthew Anderson Network Security Specialist Enhanced Telecommunications

2 1

SSL3_GET_CLIENT_KEY_EXCHANGE
by Juan Daniel Moreno 28 Sep '05

28 Sep '05

Hi everyone, I have a problem and I would like to ask you what to do. My problem is with PEAP protocol when I send the Client_Key_Exchange. FreeRadius 1.0.4 server tells me: SSL3_GET_CLIENT_KEY_EXCHANGE: tls rsa encrypted value length is wrong: s3_srvr.c: 1450: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. I am using OpenSSL libraries and everything seems to work (the key is found by the X509_get_pubkey). And I send all this data with RSA_public_encrypt(). I don't know what I'm doing wrong. Please help me! THANKS, JUAN

1 0

RE: rlm_perl
by Abdul Lateef 28 Sep '05

28 Sep '05

Hi, Thanks for your reply. i am going here to post the debug logs. from the log it seems rlm_per is loaded successfully but when i am trying to call authorize and authenticate function from example.pl, the functions are not calling well. Here is full configuration what i did to work with perl module. radreply table: ------------------- 123456 Auth-Type := perl ------------------- radiusd.conf --------------------- modules area: perl { module = /usr/local/etc/example.pl func_accounting = accounting func_authenticate = authenticate func_authorize = authorize func_preacct = preacct func_checksimul = checksimul func_xlat = xlat } authorize { preprocess chap suffix perl } authenticate { Auth-Type Perl { perl } } --------------------- example.pl -------------------- sub authorize { return RLM_MODULE_OK; } sub authenticate { if ($RAD_REQUEST{'User-Name'} =~ /^baduser/i) { $RAD_REPLY{'Reply-Message'} = "Denied access"; return RLM_MODULE_REJECT; } else { $RAD_REPLY{'h323-credit-time'} = \"h323-credit-time=200\"; return RLM_MODULE_OK; } } -------------------- Here is the Log: =========================== Wed Sep 28 07:50:45 2005 : Info: Detach perl 0x93af7a0 Wed Sep 28 07:50:45 2005 : rlm_perl: rlm_perl::Detaching. Reloading. Done. Wed Sep 28 07:50:45 2005 : Info: detach at 0x93af7a0 returned status 0 Wed Sep 28 07:50:45 2005 : Info: Detach perl 0x94b0ec8 Wed Sep 28 07:50:45 2005 : rlm_perl: rlm_perl::Detaching. Reloading. Done. Wed Sep 28 07:50:45 2005 : Info: detach at 0x94b0ec8 returned status 0 Wed Sep 28 07:50:45 2005 : Info: Detach perl 0x950b550 Wed Sep 28 07:50:45 2005 : rlm_perl: rlm_perl::Detaching. Reloading. Done. Wed Sep 28 07:50:45 2005 : Info: detach at 0x950b550 returned status 0 Wed Sep 28 07:50:45 2005 : Info: Detach perl 0x9565480 Wed Sep 28 07:50:45 2005 : rlm_perl: rlm_perl::Detaching. Reloading. Done. Wed Sep 28 07:50:45 2005 : Info: detach at 0x9565480 returned status 0 Wed Sep 28 07:50:45 2005 : Info: Detach perl 0x95bf180 Wed Sep 28 07:50:45 2005 : rlm_perl: rlm_perl::Detaching. Reloading. Done. Wed Sep 28 07:50:45 2005 : Info: detach at 0x95bf180 returned status 0 Wed Sep 28 07:50:45 2005 : rlm_perl: rlm_perl::Detaching. Reloading. Done. Wed Sep 28 07:50:48 2005 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Wed Sep 28 07:50:48 2005 : Info: rlm_sql (sql): Attempting to connect to Radius@10.0.0.65:/radius Wed Sep 28 07:50:48 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Wed Sep 28 07:50:48 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 ================================================= I AM REALLY SORRY FOR BIG THREAD. -------- Yours, Abdul Lateef Computer Programmer HATIF COM Mob: +974 - 5405022 Tel: +974 - 4883068 ICQ: 276994704 YM!: abdul_zu Fax: +974 - 4883063 Doha Qatar http://www.hatif.com __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

1 0

Freeradius + EAP-TLS + DHCP = not working.
by AIbarra＠mex.boehringer-ingelheim.com 27 Sep '05

27 Sep '05

Anyoune knows the solution to this issue? Thanks beto

1 0

Installing FR 1.05
by Bill Neely 27 Sep '05

27 Sep '05

Am installing Free Radius 1.0.5 on Free BSD 5.4 OS Installation went alright, but when I fire it up, it fails to load the sql module. Here is the radiusd -x string: radiusd -x Starting - reading configuration files ... Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1645 Listening on accounting *:1646 Ready to process requests. In radiusd.conf, I have $INCLUDE ${confdir}/sql.conf What else do I need to do? Bill

6 11