September 2005 - Freeradius-Users - lists.freeradius.org

problem with MD5 EAP Radius
by dongyining 27 Sep '05

27 Sep '05

hi all, I wanted to make an AP with MD5 eap auths on the linux kernel 2.4.20,hostapd 0.4.2,madwifi 20050629,chip 5212.I have execessed in the wpa-psk mode.But when I tried the MD5 and Radius,the user can't pass the authorization.I didn't know where is the mistake.I hoped to find the same cases in the internet,but nothing found. I hope some one can help me,any suggestion will be greatly appreicated here is the DEBUG message: IEEE 802.1X: 5 bytes from 00:0c:41:c2:2f:7a IEEE 802.1X: version=1 type=1 length=0 ignoring 1 extra octets after IEEE 802.1X packet ath0: STA 00:0c:41:c2:2f:7a IEEE 802.1X: received EAPOL-Start from STA ath0: STA 00:0c:41:c2:2f:7a WPA: event 5 notification WPA: 00:0c:41:c2:2f:7a WPA_PTK entering state AUTHENTICATION2 IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state ABORTING IEEE 802.1X: 00:0c:41:c2:2f:7a BE_AUTH entering state INITIALIZE ath0: STA 00:0c:41:c2:2f:7a IEEE 802.1X: aborting authentication IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state RESTART IEEE 802.1X: Integrated EAP server in use - do not generate EAP- Request/IdentityIEEE 802.1X: 00:0c:41:c2:2f:7a BE_AUTH entering state IDLE IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE EAP: EAP entering state INITIALIZE EAP: EAP entering state SELECT_ACTION EAP: getDecision: no identity known yet -> CONTINUE EAP: EAP entering state PROPOSE_METHOD EAP: getNextMethod: type 1 EAP: EAP entering state METHOD_REQUEST EAP: building EAP-Request: Identifier 41 EAP: EAP entering state SEND_REQUEST EAP: eapReqData -> EAPOL - hexdump(len=10): 01 29 00 0a 01 68 65 6c 6c 6f EAP: EAP entering state IDLE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state CONNECTING IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state DISCONNECTED ath0: STA 00:0c:41:c2:2f:7a IEEE 802.1X: unauthorizing port madwifi_set_sta_authorized: addr=00:0c:41:c2:2f:7a authorized=0 IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state RESTART IEEE 802.1X: Integrated EAP server in use - do not generate EAP- Request/IdentityIEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE EAP: EAP entering state INITIALIZE EAP: EAP entering state SELECT_ACTION EAP: getDecision: no identity known yet -> CONTINUE EAP: EAP entering state PROPOSE_METHOD EAP: getNextMethod: type 1 EAP: EAP entering state METHOD_REQUEST EAP: building EAP-Request: Identifier 205 EAP: EAP entering state SEND_REQUEST EAP: eapReqData -> EAPOL - hexdump(len=10): 01 cd 00 0a 01 68 65 6c 6c 6f EAP: EAP entering state IDLE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state CONNECTING IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state AUTHENTICATING IEEE 802.1X: 00:0c:41:c2:2f:7a BE_AUTH entering state REQUEST IEEE 802.1X: Sending EAP Packet to 00:0c:41:c2:2f:7a (identifier 205) TX EAPOL - hexdump(len=28): 00 0c 41 c2 2f 7a 00 02 c7 23 6d 3e 88 8e 02 00 00 fIEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE Wireless event: cmd=0x8c04 len=20 ath0: STA 00:0c:41:c2:2f:7a IEEE 802.11: deassociated ath0: STA 00:0c:41:c2:2f:7a WPA: event 2 notification madwifi_del_key: addr=00:0c:41:c2:2f:7a key_idx=0 ioctl[IEEE80211_IOCTL_DELKEY]: Invalid argument WPA: 00:0c:41:c2:2f:7a WPA_PTK entering state DISCONNECTED WPA: 00:0c:41:c2:2f:7a WPA_PTK entering state INITIALIZE madwifi_del_key: addr=00:0c:41:c2:2f:7a key_idx=0 ioctl[IEEE80211_IOCTL_DELKEY]: Invalid argument IEEE 802.1X: station 00:0c:41:c2:2f:7a port disabled IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a KEY_RX entering state NO_KEY_RECEIVE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a KEY_RX entering state NO_KEY_RECEIVE EAP: EAP entering state DISABLED IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a KEY_RX entering state NO_KEY_RECEIVE EAP: State machine removed Wireless event: cmd=0x8c03 len=20 ath0: STA 00:0c:41:c2:2f:7a IEEE 802.11: associated New STA ath0: STA 00:0c:41:c2:2f:7a WPA: event 1 notification ath0: STA 00:0c:41:c2:2f:7a IEEE 802.1X: start authentication EAP: State machine created IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a BE_AUTH entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_KEY_TX entering state NO_KEY_TRANSMIT IEEE 802.1X: 00:0c:41:c2:2f:7a KEY_RX entering state NO_KEY_RECEIVE IEEE 802.1X: 00:0c:41:c2:2f:7a CTRL_DIR entering state IN_OR_BOTH IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a BE_AUTH entering state IDLE IEEE 802.1X: 00:0c:41:c2:2f:7a KEY_RX entering state NO_KEY_RECEIVE IEEE 802.1X: 00:0c:41:c2:2f:7a CTRL_DIR entering state FORCE_BOTH IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a KEY_RX entering state NO_KEY_RECEIVE ath0: STA 00:0c:41:c2:2f:7a WPA: start authentication WPA: 00:0c:41:c2:2f:7a WPA_PTK entering state INITIALIZE madwifi_del_key: addr=00:0c:41:c2:2f:7a key_idx=0 WPA: 00:0c:41:c2:2f:7a WPA_PTK_GROUP entering state IDLE WPA: 00:0c:41:c2:2f:7a WPA_PTK entering state AUTHENTICATION WPA: 00:0c:41:c2:2f:7a WPA_PTK entering state AUTHENTICATION2 IEEE 802.1X: 5 bytes from 00:0c:41:c2:2f:7a IEEE 802.1X: version=1 type=1 length=0 ignoring 1 extra octets after IEEE 802.1X packet ath0: STA 00:0c:41:c2:2f:7a IEEE 802.1X: received EAPOL-Start from STA ath0: STA 00:0c:41:c2:2f:7a WPA: event 5 notification WPA: 00:0c:41:c2:2f:7a WPA_PTK entering state AUTHENTICATION2 IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state DISCONNECTED ath0: STA 00:0c:41:c2:2f:7a IEEE 802.1X: unauthorizing port madwifi_set_sta_authorized: addr=00:0c:41:c2:2f:7a authorized=0 IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state RESTART IEEE 802.1X: Integrated EAP server in use - do not generate EAP- Request/IdentityIEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE EAP: EAP entering state INITIALIZE EAP: EAP entering state SELECT_ACTION EAP: getDecision: no identity known yet -> CONTINUE EAP: EAP entering state PROPOSE_METHOD EAP: getNextMethod: type 1 EAP: EAP entering state METHOD_REQUEST EAP: building EAP-Request: Identifier 186 EAP: EAP entering state SEND_REQUEST EAP: eapReqData -> EAPOL - hexdump(len=10): 01 ba 00 0a 01 68 65 6c 6c 6f EAP: EAP entering state IDLE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state CONNECTING IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a AUTH_PAE entering state AUTHENTICATING IEEE 802.1X: 00:0c:41:c2:2f:7a BE_AUTH entering state REQUEST IEEE 802.1X: Sending EAP Packet to 00:0c:41:c2:2f:7a (identifier 186) TX EAPOL - hexdump(len=28): 00 0c 41 c2 2f 7a 00 02 c7 23 6d 3e 88 8e 02 00 00 fIEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE IEEE 802.1X: 00:0c:41:c2:2f:7a Port Timers TICK (timers: 0 0 3599) IEEE 802.1X: 00:0c:41:c2:2f:7a REAUTH_TIMER entering state INITIALIZE ....... here is the hostapd.conf interface=ath0 driver=madwifi logger_syslog=-1 logger_syslog_level=2 logger_stdout=-1 logger_stdout_level=2 debug=4 dump_file=/tmp/hostapd.dump ssid=dongyining macaddr_acl=2 accept_mac_file=/etc/hostapd.accept deny_mac_file=/etc/hostapd.deny auth_algs=1 ieee8021x=1 eapol_key_index_workaround=1 eap_reauth_period=3600 eap_server=1 eap_user_file=/etc/hostapd.eap_user own_ip_addr=192.168.1.1 auth_server_addr=192.168.1.1 auth_server_port=1812 auth_server_shared_secret=secret radius_retry_primary_interval=600 radius_acct_interim_interval=600 radius_server_clients=/etc/hostapd.radius_clients radius_server_auth_port=1812 wpa=3 wpa_passphrase=dongyining wpa_key_mgmt=WPA-PSK WPA-EAP wpa_pairwise=TKIP CCMP wpa_group_rekey=600 wpa_strict_rekey=1 wpa_gmk_rekey=86400 rsn_preauth=1 here is the hostapd.eap_user # Phase 1 users "FORD" MD5 "secret"

2 1

How to run CA.all script to generate EAP-TLS certifiate
by ann lee 26 Sep '05

26 Sep '05

Hi,all: I am new to freeradius world. I am trying to setup EAP-TLS using freeradius server. Would you pls tell me which cisco access point is preferred for the EAP-TLS setup? I have installed openssl-0.9.8 and freeradius-1.0.5 on Redhat 9.0. I tried several times to generate certificate by runing CA.all script which was downloaded from www.missl.cs.umd.edu/wireless/eaptls. But each time I met same issue and failed to generate the certificates. I just typed "./CA.all" to run the script, is there any optional parameters need I input ? (I did not update the file /usr/local/openssl/ssl/openssl.cnf and CA.all) the following is part of the error log: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:whatever An optional company name []:radius Using configuration from /usr/local/openssl/ssl/openssl.cnf Enter pass phrase for ./demoCA/private/cakey.pem: (I entered "whatever" for pass phrase, right? I don't know what is the pass phrase?) ./demoCA/serial: No such file or directory (I think this file ./demoCA/serial will be created automatically when running the CA.all, right?) error while loading serial number 4427:error:02001002:system library:fopen:No such file or directory:bss_file.c:349:fopen('./demoCA/serial','r') 4427:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:351: No certificate matches private key 4429:error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long:asn1_lib.c:150: unable to load certificate 4430:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:644:Expecting: TRUSTED CERTIFICATE Enclosed is the complete log of runing the script CA.all. I am not clear the root cause. Your help is very appreciated. had better provide me a successful log of running the CA.all. I don't know which information I should input when runing the CA.all. Thanks a lot ann --------------------------------- 雅虎免费G邮箱－中国第一绝无垃圾邮件骚扰超大邮箱雅虎助手－搜索、杀毒、防骚扰 run ./CA.all ################## create private key name : name-root CA.pl -newcert ################## Generating a 1024 bit RSA private key ...........++++++ ..................++++++ writing new private key to 'newreq.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:CN State or Province Name (full name) [Some-State]:Beijing Locality Name (eg, city) []:Beijing Organization Name (eg, company) [Internet Widgits Pty Ltd]:OpenTide Organizational Unit Name (eg, section) []:IT Solution Common Name (eg, YOUR name) []:wanghao Email Address []:wanghao@opentide.com.cn ################## create CA use just created 'newreq.pem' private key as filename CA.pl -newca ################## CA certificate filename (or enter to create) ################## exporting ROOT CA CA.pl -newreq CA.pl -signreq openssl pkcs12 -export -in demoCA/cacert.pem -inkey newreq.pem -out root.pem openssl pkcs12 -in root.cer -out root.pem ################## MAC verified OK ################## creating client certificate name : name-clt client certificate stored as cert-clt.pem CA.pl -newreq CA.pl -signreq ################## Generating a 1024 bit RSA private key ..................++++++ ..........................++++++ writing new private key to 'newreq.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:CN State or Province Name (full name) [Some-State]:Beijing Locality Name (eg, city) []:Beijing Organization Name (eg, company) [Internet Widgits Pty Ltd]:OpenTide Organizational Unit Name (eg, section) []:IT Solution Common Name (eg, YOUR name) []:wanghao Email Address []:wanghao@opentide.com.cn Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:whatever An optional company name []:radius Using configuration from /usr/local/openssl/ssl/openssl.cnf Enter pass phrase for ./demoCA/private/cakey.pem: ./demoCA/serial: No such file or directory error while loading serial number 4427:error:02001002:system library:fopen:No such file or directory:bss_file.c:349:fopen('./demoCA/serial','r') 4427:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:351: No certificate matches private key 4429:error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long:asn1_lib.c:150: unable to load certificate 4430:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:644:Expecting: TRUSTED CERTIFICATE ################## creating server certificate name : name-srv server certificate stored as cert-srv.pem CA.pl -newreq CA.pl -signreq ################## Generating a 1024 bit RSA private key ..............................++++++ ..........++++++ writing new private key to 'newreq.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:

1 0

Dictionary include error.
by Joseph 26 Sep '05

26 Sep '05

I am trying to include the dictionary.starent and getting the following error: Errors reading dictionary: dict_init: /etc/freeradius/dictionary.starent[41]: dict_addattr: ATTRIBUTE has invalid number (larger than 255). Any ideas on what would cause this? Here is the line in my dictionary file: $INCLUDE /usr/share/freeradius/dictionary $INCLUDE dictionary.starent Running on debian sarge with snapshot copy of freeradius because I need the starent dictionary. -- J

2 1

RE: Maximum size Input-Octets/Output-Octets
by Jonathan De Graeve 26 Sep '05

26 Sep '05

So is it 2147483648 or 2147483647? J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Guy Fraser Verzonden: maandag 26 september 2005 17:45 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: RE: Maximum size Input-Octets/Output-Octets On Fri, 2005-23-09 at 19:42 +0200, Jonathan De Graeve wrote: > > What "radacct" are you talking about? The Acct-Input-Octets stops > >at 2G because the RFC dictates that it's a 32-bit integer. That's why > >the Acct-Input-Gigawords attribute was defined. It goes past 2G. > > I'm talking about the detail file from freeradius. > > This is what I found in RFC2869 > > 5.1. Acct-Input-Gigawords > > Description > > This attribute indicates how many times the Acct-Input-Octets > counter has wrapped around 2^32 over the course of this service > being provided, and can only be present in Accounting-Request > records where the Acct-Status-Type is set to Stop or Interim- > Update. > > So I assumed that the wrapping went @ 4GB instead of 2GB > > >From RFC2866: > > Value > > The Value field is four octets. > > Also: > > integer 32 bit unsigned value, most significant octet first. > > So its 32bit. (4GB right??) > > I will use 2147483647 for now. But I can't find the definition which > says that it should be 2GB so I need to be sure. > > J. What is right and what is in common use may be two different things. In my experience, some NAS vendors generate negative numbers when the Octet Value is greater than 2^31. By the way a GigaWord is 2147483648 bytes since a Word = 2 Bytes and Giga = 1024*1024*1024 = 1073741824. It would therefore make sense to use a modulo of 2147483648 for the Octet value which holds the "remainder" of the full byte count. Just in case you were wondering what a TeraQuad was after watching a Star Trek NG episode it is 4398046511104 Bytes. ;^) - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

LDAP Radius -x help...
by Cris Boisvert 26 Sep '05

26 Sep '05

Running Freeradius on fedora core 4 When I use Radiusd -X I can authenticate via the ldap server I have running.. But when I start radius normally "service radiusd start" it starts but the error log says It can't talk to The ldap server.. Ideas? Why would it working in debug but not normally? Here's the log info --------------------------------Radius log----------------------------------- Mon Sep 26 15:55:27 2005 : Info: Using deprecated naslist file. Support for this will go away soon. Mon Sep 26 15:55:27 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Mon Sep 26 15:55:27 2005 : Info: Ready to process requests. Mon Sep 26 15:55:30 2005 : Error: rlm_ldap: bind to 192.168.77.6:389 failed: Can't contact LDAP server Mon Sep 26 15:55:30 2005 : Error: rlm_ldap: (re)connection attempt failed ------------------radius x output ----------------------------------------- modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "wow(a)pork.com" with password "test1234" radius_xlat: '(mail=wow(a)pork.com)' radius_xlat: 'o=pork.com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.77.6:389, authentication 0 rlm_ldap: bind as / to 192.168.77.6:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=pork.com, with filter (mail=wow(a)pork.com) rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: user DN: uid=wow,ou=People,o=pork.com rlm_ldap: (re)connect to 192.168.77.6:389, authentication 1 rlm_ldap: bind as uid=wow,ou=People,o=pork.com/test1234 to 192.168.77.6:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user wow(a)pork.com authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 26 to 192.168.77.6:3665 Finished request 0

1 0

Freeradius LDAP
by Cris Boisvert 26 Sep '05

26 Sep '05

Cris Boisvert wrote: > I'm setting up freeradius to talk to a Ipswitch Imail server for > authetication. > > Just needs to do the basic User Pass... Ok. > > [..] > A snippet of the config. > ----------------------------------------------- > ldap { > server = "192.168.77.6" > #identity = "cn=root,o=My Org,c=UA" > #password = test1234 > basedn = "o=My Org,c=UA" > #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" > # base_filter = "(objectclass=radiusprofile)" > > # set this to 'yes' to use TLS encrypted connections > ______________---------------------------------------------- > [..] > Below is a Cut form radiusd -X debug.. > > Anyone have any reccomendations>? > > > > modcall: group authorize returns ok for request 0 > rad_check_password: Found Auth-Type LDAP > auth: type "LDAP" > Processing the authenticate section of radiusd.conf > modcall: entering group Auth-Type for request 0 > rlm_ldap: - authenticate > rlm_ldap: login attempt by "test at pork.com" with password "test" > radius_xlat: '(uid=test at pork.com)' > radius_xlat: 'o=My Org,c=UA' Do you really have an object with attribute iud="test at pork.com"? I think you should split the username with delimiter '@', so you search for uid=test,dc=pork,dc=com (or similiar). But if you have such objects, try ldap_debug=0xffff between ldap { } in your radiusd.conf. Linus van Geuns For testing purposes I do have a user of test(a)pork.com I have set the debug option to 0xffff .. Their was no more debug info than before. Where in the radiusd.conf am I supposed to put "uid=test,dc=pork,dc=com " reference? Sorry I'm not really up on ldap.. Thanx

1 0

PEAP Protocol
by Juan Daniel Moreno 26 Sep '05

26 Sep '05

Hi everyone, I have a little problem with freeradius 1.0.4. It's maybe something I don't understand but I really need help. With PEAP protocol, I have a user test with its own password. The first 8 packets are fine but as I send the 9th, radius says Length in packet header doesn't match actual length. Does it means that the length in the first packet (when I send a two packets certificate) is greater or less than in second packet? Or is just the header length in this very packet? Thank you four your help. Juan Daniel MORENO

2 1

Re: Cant make in openbsd3.7 freeradius 1.0.5
by Lou Goddard 26 Sep '05

26 Sep '05

Alan, Here are the errors. gmake[5]: Leaving directory `/home/lou/freeradius-1.0.5/src/modules/rlm_files' Making static dynamic in rlm_ippool... gmake[5]: Entering directory `/home/lou/freeradius-1.0.5/src/modules/rlm_ippool' gmake[5]: Nothing to be done for `static'. gmake[5]: Nothing to be done for `dynamic'. gmake[5]: Leaving directory `/home/lou/freeradius-1.0.5/src/modules/rlm_ippool' Making static dynamic in rlm_krb5... gmake[5]: Entering directory `/home/lou/freeradius-1.0.5/src/modules/rlm_krb5' gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../../include -I/usr/include/et -c rlm_krb5.c -o rlm_krb5.o rlm_krb5.c:39:18: krb5.h: No such file or directory rlm_krb5.c:45: error: syntax error before "krb5_context" rlm_krb5.c:57: error: syntax error before "context" rlm_krb5.c:59: warning: function declaration isn't a prototype rlm_krb5.c: In function `verify_krb5_tgt': rlm_krb5.c:62: error: syntax error before "princ" rlm_krb5.c:63: error: `krb5_keyblock' undeclared (first use in this function) rlm_krb5.c:63: error: (Each undeclared identifier is reported only once rlm_krb5.c:63: error: for each function it appears in.) rlm_krb5.c:63: error: `keyblock' undeclared (first use in this function) rlm_krb5.c:64: error: syntax error before "packet" rlm_krb5.c:72: error: `instance' undeclared (first use in this function) rlm_krb5.c:87: error: `packet' undeclared (first use in this function) rlm_krb5.c:88: warning: implicit declaration of function `krb5_sname_to_principal' rlm_krb5.c:88: error: `context' undeclared (first use in this function) rlm_krb5.c:89: error: `KRB5_NT_SRV_HST' undeclared (first use in this function) rlm_krb5.c:89: error: `princ' undeclared (first use in this function) rlm_krb5.c:92: error: `user' undeclared (first use in this function) rlm_krb5.c:96: warning: implicit declaration of function `krb5_princ_component' rlm_krb5.c:96: error: `c' undeclared (first use in this function) rlm_krb5.c:96: error: invalid type argument of `->' rlm_krb5.c:104: warning: implicit declaration of function `krb5_kt_read_service_key' rlm_krb5.c:105: error: `ENCTYPE_DES_CBC_MD5' undeclared (first use in this function) rlm_krb5.c:113: warning: implicit declaration of function `krb5_free_keyblock' rlm_krb5.c:116: warning: implicit declaration of function `krb5_mk_req' rlm_krb5.c:116: error: `auth_context' undeclared (first use in this function) rlm_krb5.c:117: error: `ccache' undeclared (first use in this function) rlm_krb5.c:119: warning: implicit declaration of function `krb5_auth_con_free' rlm_krb5.c:131: warning: implicit declaration of function `krb5_kt_resolve' rlm_krb5.c:131: error: `keytab' undeclared (first use in this function) rlm_krb5.c:135: warning: implicit declaration of function `krb5_kt_default' rlm_krb5.c:147: warning: implicit declaration of function `krb5_rd_req' rlm_krb5.c:150: warning: redundant redeclaration of `krb5_auth_con_free' in same scope rlm_krb5.c:119: warning: previous declaration of `krb5_auth_con_free' rlm_krb5.c:152: warning: implicit declaration of function `krb5_kt_close' rlm_krb5.c:164: warning: implicit declaration of function `krb5_free_data_contents' rlm_krb5.c: In function `krb5_instantiate': rlm_krb5.c:174: error: `krb5_context' undeclared (first use in this function) rlm_krb5.c:174: error: `context' undeclared (first use in this function) rlm_krb5.c:185: error: structure has no member named `context' rlm_krb5.c:187: warning: implicit declaration of function `krb5_init_context' rlm_krb5.c: In function `krb5_detach': rlm_krb5.c:203: error: structure has no member named `context' rlm_krb5.c: In function `krb5_auth': rlm_krb5.c:215: error: syntax error before "tgtname" rlm_krb5.c:213: warning: unused variable `r' rlm_krb5.c:211: warning: unused parameter `instance' rlm_krb5.c:211: warning: unused parameter `request' rlm_krb5.c: At top level: rlm_krb5.c:220: error: syntax error before "kcreds" rlm_krb5.c:220: warning: type defaults to `int' in declaration of `kcreds' rlm_krb5.c:220: warning: data definition has no type or storage class rlm_krb5.c:221: error: syntax error before "ccache" rlm_krb5.c:221: warning: type defaults to `int' in declaration of `ccache' rlm_krb5.c:221: error: `ccache' used prior to declaration rlm_krb5.c:221: warning: data definition has no type or storage class rlm_krb5.c:224: error: syntax error before "context" rlm_krb5.c:224: warning: type defaults to `int' in declaration of `context' rlm_krb5.c:224: error: `context' used prior to declaration rlm_krb5.c:224: error: `instance' undeclared here (not in a function) rlm_krb5.c:224: warning: data definition has no type or storage class rlm_krb5.c:225: error: `user' used prior to declaration rlm_krb5.c:231: error: syntax error before "if" rlm_krb5.c:59: warning: `verify_krb5_tgt' defined but not used rlm_krb5.c:171: warning: `krb5_instantiate' defined but not used rlm_krb5.c:202: warning: `krb5_detach' defined but not used rlm_krb5.c:212: warning: `krb5_auth' defined but not used rlm_krb5.c:210:1: unterminated #ifndef gmake[5]: *** [rlm_krb5.o] Error 1 gmake[5]: Leaving directory `/home/lou/freeradius-1.0.5/src/modules/rlm_krb5' gmake[4]: *** [common] Error 2 gmake[4]: Leaving directory `/home/lou/freeradius-1.0.5/src/modules' gmake[3]: *** [all] Error 2 gmake[3]: Leaving directory `/home/lou/freeradius-1.0.5/src/modules' gmake[2]: *** [common] Error 2 gmake[2]: Leaving directory `/home/lou/freeradius-1.0.5/src' gmake[1]: *** [all] Error 2 gmake[1]: Leaving directory `/home/lou/freeradius-1.0.5/src' gmake: *** [common] Error 2 *** Error code 2

2 1

radutmp
by TK Lew 26 Sep '05

26 Sep '05

hi :: Is radutmp attributes can added ? What I need to do if I want "called-station-id" attribute to be display when run "radwho -R" ? Thank for any reply. Regards

2 1

Forcing authorization access-reject depending on attribute
by Mike Chamberlain 26 Sep '05

26 Sep '05

Hi there. I am using freeradius to authenticate users to a ChilliSpot wireless hotspot. It's backended by a SQL database and communicating using stored procedures. My problem is as follows. On authentication, the user enters their username and password. This calls a stored procedure which returns the correct password, leaving it up to the gateway to determine if the password they entered is correct. This is all no problem. The problem arises on the authorization. Even though the user may have supplied the correct username and password, they may not have enough credit to use the service. The problem is that there is no radius attribute that I can pass back to the ChilliSpot gateway to indicate that the user should not be allowed service. No matter what attributes I add, the radius message is always an Access-Accept. (For VoIP people, what I really want is the equivalent of the h323-return-code attribute, but sadly there doesn't appear to be anything like this in the WISPr specification.) I have been advised that it might be possible to return an arbitrary Access-Reject if I use scripting. I was thinking that perhaps it would be possible for freeradius to examine a particular attribute in the authorization response, and depending on the value change the message to be an Access-Reject. However, I am kind of stuck with this as I am new to freeradius and have no idea where to start. Does anyone know whether this would be the correct approach? If so, are there any sites or examples to get me started on this? If not, can anyone think of a better way to accomplish what I am trying? Thanks in advance for your help, Mike

3 2