September 2005 - Freeradius-Users - lists.freeradius.org

No appropriate error message ("rlm_ldap: could not start TLS Connect error")
by Linus van Geuns 23 Sep '05

23 Sep '05

Hi! I've tried to establish a TLS-secured connection between freeradius-1.0.1-3 (Red Hat Enterprise Linux 4) and a openldap server. I tried every combination of tls_mode, start_tls and tls_require_cert, but I never got more than this error: (/etc/raddb/radiusd.conf) -------------------8<---------------------------------------- ldap { server = "MYLDAPSERVER.ira.uka.de" port = 389 identity = "uid=MYUSERNAME, ou=MYUNIT, dc=ira, dc=uka, dc=de" password = MYPASSWORD basedn = "ou=MYUNIT,dc=ira,dc=uka,dc=de" filter = "(uid=MYPREFIX-%u)" start_tls = yes tls_mode = no tls_cacertdir = /etc/raddb/cacerts/ tls_require_cert = demand dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 # No useful error msg w/o 0xffff ldap_debug = 0xffff } -------------------8<---------------------------------------- (/var/log/radius/radius.log) -------------------8<---------------------------------------- Error: rlm_ldap: could not start TLS Connect error Error: rlm_ldap: (re)connection attempt failed -------------------8<---------------------------------------- The problem was: (/usr/sbin/radiusd -X) -------------------8<---------------------------------------- TLS trace: SSL_connect:before/connect initialization TLS trace: SSL_connect:SSLv2/v3 write client hello A TLS trace: SSL_connect:SSLv3 read server hello A TLS certificate verification: depth: 1, err: 0, subject: /C=DE/ST=Baden/L=Karlsruhe/O=Universitaet Karlsruhe/OU=ATIS, Fakultaet fuer Informatik/CN=MYCACERTIFICATE/emailAddress=MYCA(a)MYSERVER.PRI, issuer: /C=DE/ST=Baden/L=Karlsruhe/O=Universitaet Karlsruhe/OU=ATIS, Fakultaet fuer Informatik/CN=MYCACERTIFICATE/emailAddress=MYCA(a)MYSERVER.PRI TLS certificate verification: depth: 0, err: 0, subject: /C=DE/ST=Germany/L=Karlsruhe/O=Universitaet Karlsruhe/OU=ATIS/CN=MYLDAPSERVER.ira.uni-karlsruhe.de/emailAddress=MYMAIL(a)MYSERVER.PRI, issuer: /C=DE/ST=Baden/L=Karlsruhe/O=Universitaet Karlsruhe/OU=ATIS, Fakultaet fuer Informatik/CN=MYCACERTIFICATE/emailAddress=MYMAIL(a)MYSERVER.PRI TLS trace: SSL_connect:SSLv3 read server certificate A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A TLS trace: SSL_connect:SSLv3 flush data TLS trace: SSL_connect:SSLv3 read finished A TLS: hostname (MYLDAPSERVER.ira.uka.de) does not match common name in certificate (MYLDAPSERVER.ira.uni-karlsruhe.de). rlm_ldap: ldap_start_tls_s() ldap_err2string rlm_ldap: could not start TLS Connect error ldap_free_connection ldap_send_unbind ldap_free_connection: actually freed TLS trace: SSL3 alert write:warning:close notify rlm_ldap: (re)connection attempt failed rlm_ldap: search failed -------------------8<---------------------------------------- The importent one is: TLS: hostname (MYLDAPSERVER.ira.uka.de) does not match common name in certificate (MYLDAPSERVER.ira.uni-karlsruhe.de). MYLDAPSERVER.ira.uka.de is an alias for MYLDAPSERVER.ira.uni-karlsruhe.de (hostname used in the certificate). After I set server = MYLDAPSERVER.ira.uni-karlsruhe.de in my radiusd.conf the TLS connection worked without any problem. Maybe this mail will save someone the amount of time I had to waste, figuring it out.. :-/ _And_ maybe this mail inspires some of the developers to report the appropriate error message instead of "rlm_ldap: could not start TLS Connect error". Linus van Geuns. PS: Every certificate of an certificate authority in <tls_cacertdir> needs to be accessable by it's openssl-hash as filename. This can be achieved as follows: In <tls_cacertdir> run: CERT=CACERTFILENAME;ln ${CERT} `openssl x509 -noout -hash -in ${CERT} `.0 -s

3 10

freeRadius with LDAP for MSCHAP & mac auth
by Seferovic Edvin 23 Sep '05

23 Sep '05

Hello everyone... Ive set up a freeradius server with LDAP backend for MSCHAP, but now I have to set up a mac based auth on the same server also with the same LDAP backend ( but the mac info is found in another subtree ). So I have made two ldap instances under modules including MSCHAP... modules { mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes } ldap ldap_users { server = "81.yyy.xxx.xxx" basedn = "ou=People,dc=xxx,dc=xxx" filter = "(&(objectClass=posixAccount)(uid=%u))" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 10 timeout = 4 timelimit = 3 net_timeout = 1 } ldap ldap_mac { server = "81.xxx.xxx.xxx" basedn = "ou=Hosts,dc=xxx,dc=xxx" filter = "(&(objectClass=ipHost)(ipHostNumber=%u))" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 10 timeout = 4 timelimit = 3 net_timeout = 1 } ... } // modules end instantiate { weekly_traffic // just a counter } authorize { mschap ldap_users ldap_mac weekly_traffic } authenticate { # MSCHAP authentication. Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap_mac ldap_users } } So what I actually need is - when my vpn server sends Access-Request packets with MS-CHAP attributes, I would like mschap module to use the "ldap_users" part. And when an Access-Request packet with the mac address is recieved I would like to use ldap_mac ONLY ! here is a part of my log file... rad_recv: Access-Request packet from host 172.19.10.2:1024, id=22, length=193 Framed-MTU = 1480 NAS-IP-Address = 172.19.10.2 NAS-Identifier = "HP2626-Verwaltung" User-Name = "00:0a:e4:22:c5:9d" Service-Type = Administrative-User Framed-Protocol = PPP NAS-Port = 10 NAS-Port-Type = Ethernet NAS-Port-Id = "10" Called-Station-Id = "00-14-38-2e-2c-76" Calling-Station-Id = "00-0a-e4-22-c5-9d" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" CHAP-Password = 0x1525d56e4e21bbbc83d5e49fa3be8173a5 Debug: Processing the authorize section of radiusd.conf Debug: modcall: entering group authorize for request 0 Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 0 Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 0 Debug: modcall[authorize]: module "mschap" returns noop for request 0 Debug: modsingle[authorize]: calling ldap_users (rlm_ldap) for request 0 Debug: rlm_ldap: - authorize Debug: rlm_ldap: performing user authorization for 00:0a:e4:22:c5:9d Debug: radius_xlat: '(&(objectClass=posixAccount)(uid=00:0a:e4:22:c5:9d))' Debug: radius_xlat: 'ou=People,dc=kolp,dc=at' Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Debug: rlm_ldap: attempting LDAP reconnection Debug: rlm_ldap: (re)connect to 81.189.101.10:389, authentication 0 Debug: rlm_ldap: bind as / to 81.189.101.10:389 Debug: rlm_ldap: waiting for bind result ... Debug: rlm_ldap: Bind was successful Debug: rlm_ldap: performing search in ou=People,dc=kolp,dc=at, with filter (&(objectClass=posixAccount)(uid=00:0a:e4:22:c5:9d)) Debug: rlm_ldap: object not found or got ambiguous search result Debug: rlm_ldap: search failed Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Debug: modsingle[authorize]: returned from ldap_users (rlm_ldap) for request 0 Debug: modcall[authorize]: module "ldap_users" returns notfound for request 0 Debug: modsingle[authorize]: calling ldap_mac (rlm_ldap) for request 0 Debug: rlm_ldap: - authorize Debug: rlm_ldap: performing user authorization for 00:0a:e4:22:c5:9d Debug: radius_xlat: '(&(objectClass=ipHost)(ipHostNumber=00:0a:e4:22:c5:9d))' Debug: radius_xlat: 'ou=Hosts,dc=kolp,dc=at' Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Debug: rlm_ldap: attempting LDAP reconnection Debug: rlm_ldap: (re)connect to 81.189.101.10:389, authentication 0 Debug: rlm_ldap: bind as / to 81.189.101.10:389 Debug: rlm_ldap: waiting for bind result ... Debug: rlm_ldap: Bind was successful Debug: rlm_ldap: performing search in ou=Hosts,dc=kolp,dc=at, with filter (&(objectClass=ipHost)(ipHostNumber=00:0a:e4:22:c5:9d)) Debug: rlm_ldap: looking for check items in directory... Debug: rlm_ldap: looking for reply items in directory... Debug: rlm_ldap: Adding description as vid, value 20 & op=11 Debug: rlm_ldap: user 00:0a:e4:22:c5:9d authorized to use remote access Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Debug: modsingle[authorize]: returned from ldap_mac (rlm_ldap) for request 0 Debug: modcall[authorize]: module "ldap_mac" returns ok for request 0 Debug: modsingle[authorize]: calling weekly_traffic (rlm_counter) for request 0 Debug: rlm_counter: Entering module authorize code Debug: rlm_counter: Could not find Check item value pair Debug: modsingle[authorize]: returned from weekly_traffic (rlm_counter) for request 0 Debug: modcall[authorize]: module "weekly_traffic" returns noop for request 0 Debug: modcall: group authorize returns ok for request 0 Debug: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Sorry for the long mail :( Thank you in advance ! Regards, Edvin Seferovic

1 0

Cant make in openbsd3.7 freeradius 1.0.5
by Lou Goddard 23 Sep '05

23 Sep '05

Greetings, Is anyone else having issues compiling freeradius under openbsd?

2 1

Authorization how to
by Mahesh S Kudva 23 Sep '05

23 Sep '05

Hi I have setup radius to have authentication. How do I authorize users to access specific resources for some and allow full access to others. Regards & Thanks ================ Mahesh S Kudva ------------------------------------------------------- Robosoft Technologies - Partners in Product Development

1 0

RE: Maximum size Input-Octets/Output-Octets
by Jonathan De Graeve 23 Sep '05

23 Sep '05

Ok, I also have another question: Freeradius seems to use signed integers for the Acc-Input/Output-Octets Fri Sep 23 16:59:03 2005 Service-Type = Login-User User-Name = "jonathan" NAS-Identifier = "hotspot-2.wlan.imz.be" NAS-Port = 0 NAS-Port-Type = Ethernet Acct-Status-Type = Alive Acct-Authentic = RADIUS Acct-Session-Id = "4bd8b325bdeafd2d" Acct-Terminate-Cause = User-Request Acct-Session-Time = 1353 Acct-Input-Octets = 46596288 Acct-Input-Packets = 1163323 Acct-Input-Gigawords = 0 Acct-Output-Octets = 2147483647 Acct-Output-Packets = 1787355 Acct-Output-Gigawords = 0 Called-Station-Id = "194.8.52.38" Calling-Station-Id = "192.168.2.255" Framed-IP-Address = 192.168.2.255 NAS-IP-Address = 194.8.52.38 Proxy-State = 0x3836 Client-IP-Address = 194.8.52.85 Acct-Unique-Session-Id = "925f85fa82a0afb0" Timestamp = 1127487543 The source really sends unsigned 32bit. Any idea why radacct just stops @ 2GB I've implemented Gigawords as follows: function gigawords($bytes) { /* We use BCMath functions since normal integers don't work */ $gigawords = bcdiv( bcsub( $bytes, remainder($bytes) ) , 4294967295); return $gigawords; } function remainder($bytes) { /* Calculate the remainder */ $bytes = bcmod($bytes, 4294967295); return $bytes; -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Alan DeKok Verzonden: vrijdag 23 september 2005 16:39 Aan: FreeRadius users mailing list Onderwerp: Re: Maximum size Input-Octets/Output-Octets "Jonathan De Graeve" <Jonathan.De.Graeve(a)imelda.be> wrote: > Is it 2^32 or (2^32 - 1) 2^32 can't be represented in a 32-bit number. It has 33 bits of data... Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Maximum size Input-Octets/Output-Octets
by Jonathan De Graeve 23 Sep '05

23 Sep '05

Is it 2^32 or (2^32 - 1) I'm programming a radius client and i'm at the gigawords stuff... J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite ---------

2 1

Wrong sequence of packets during re-authentication
by Bilal Shahid 23 Sep '05

23 Sep '05

Hello all, During my 802.1X Supplicant's re-authentication (using EAP-TTLS) with FreeRADIUS using DLINK switch, I face the following scenario: Sometimes "during re-authentication", one of the FreeRADIUS's replies does not reach the DLINK switch. When DLINK's RADIUS timer expires, it re-starts the re-authentication by sending the Supplicant's identity to FreeRADIUS. At this time, an initial couple of packets are exchanges correctly, however then it seems that FreeRADIUS wants to skip some of the packets and complete the authentication whereas my Supplicant wants to re-do everything. For example, during a 'correct re-authentication", FreeRADIUS sends the following packet: TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0067], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 05ca], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A However, during the "incorrect" re-authentication cycle, which has been started due to a packet loss in the middle as explained above, FreeRADIUS send the following packet: TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0067], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read finished A Note that this time FreeRADIUS has sent ChangeCipherSpec and Finished instead of Certificate and ServerHelloDone. Is this the normal and correct behavior? My Supplicant's response to this packet is then liked by the FreeRADIUS and its sends an alert. Could someone please help me understanding this problem. Thanks, Bilal _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

is this possible ?
by TK Lew 23 Sep '05

23 Sep '05

hi : I am not sure that anyone have done this before :: We have a customer using Steelbelt radius that forward accounting information to the freeradius server. We can receive the accounting packet and stored it successfully. But the problem is we have another application that will do a mapping from IP address to MSISDN. In order to do the mapping from IP to MSISDN , the application need to talk?? to a radius server that have the information (that means freeradius that receive the accounting packet). The flow is below :: handset --> authenticated successfully --> Steelbelt radius forward accounting packet to Freeradius and the application will the a lookup for MSISDN that match the IP address before allow the handset to use the services. Is this possible ?? The application managed to authenticate itself successfully with Freeradius but I just cannot send the matching MSISDN back to the application. I have tried to use the variable such as %{Calling-Station-Id} in the access-repky message but no values assign. Any helps ? Thanks

3 4

RE: howto reset rlm_sqlcounter
by Bart van Daal 23 Sep '05

23 Sep '05

thanks for your reply Alan, I didn't mean the max-all-sessions value but the actual counter value. If a user has 15600seconds of online time ad is online for e.g. 3600 seconds, where do these 3600 seconds get stored with rlm_sqlcounter? thanks, kind regards, Bart van Daal -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: donderdag 22 september 2005 19:36 To: FreeRadius users mailing list Subject: Re: howto reset rlm_sqlcounter Bart van Daal <B.Vandaal(a)edpnet.net> wrote: > two possible options I think of to reset the counter are: > 1. write a program to manipulate the gdbm file. Where is this file stored? If you're using rlm_sqlcounter, it's not in a GDBM file. It's in SQL. If you're using rlm_counter, the location of the GDBM file is set in the configuration file. > 2. keep adding the minutes to the allready existing value for the > session-time. You can't do that. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

howto reset rlm_sqlcounter
by Bart van Daal 22 Sep '05

22 Sep '05

Hi All, I'm authenticating users who can buy a specified amount of time to go online. I'm using the rlm_sqlcounter module with a reset=never option because there is no specified amount of time in which users have to use their minutes. A user can also buy additional minutes or when his minutes are depleted, a new subscription. two possible options I think of to reset the counter are: 1. write a program to manipulate the gdbm file. Where is this file stored? 2. keep adding the minutes to the allready existing value for the session-time. I was wondering if there was an 'easy' way to reset the counter for a user. thanks, kind regards, Bart van Daal Bart van Daal Network Operations Van Landeghemstraat 20 9100 SINT-NIKLAAS b.vandaal(a)edpnet.net www.edpnet.be T +32 (0)3 265 67 00 F +32 (0)3 265 67 01

3 2