October 2006 - Freeradius-Users - lists.freeradius.org

RE: Securew2
by Tom Rixom 17 Oct '06

17 Oct '06

Hi All, We had a mess up with our DNS provider, moved it to our own hosted DNS. :) > the DNS has been messed up severely. though the WHOIS still is correct. > See above. > the software has been sold to a new owner.... Vista needs a good > supplicant. > Nope, but thanks for the compliment... I think.. ;) > bought out by a competitor and removed from the market. though this > would be interesting regarding its licence.... > Nope... > new version coming soon and they pulled old version prematurely In the pipeline. Regards, Tom Rixom > -----Oorspronkelijk bericht----- > Van: freeradius-users-bounces+tom.rixom=alfa- > ariss.com(a)lists.freeradius.org [mailto:freeradius-users- > bounces+tom.rixom=alfa-ariss.com(a)lists.freeradius.org] Namens > A.L.M.Buxey(a)lboro.ac.uk > Verzonden: donderdag 12 oktober 2006 17:21 > Aan: FreeRadius users mailing list > Onderwerp: Re: Securew2 > > Hi, > > Hi to all, > > anybody know what's happening to securew2 site? > > It is down from a few of week ago. > > > > Does it disappeared? > > some of us have noticed and wondered the same thing. I've resorted to > currently hosting the file for local downloads and will continue to > do so until I know whats up. (there are many other sites where is can > be publically downloaded!) > > speculation: > > the DNS has been messed up severely. though the WHOIS still is correct. > > the software has been sold to a new owner.... Vista needs a good > supplicant. > > bought out by a competitor and removed from the market. though this > would be interesting regarding its licence.... > > new version coming soon and they pulled old version prematurely > > alan > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

Re: Pam radius authentication
by danieldinu＠rdslink.ro 17 Oct '06

17 Oct '06

First of all, thank you for your reply. Until now, you are the only one. Now, let's take it step by step: This is a part of INSTALL: ********************************************************************** Redhat Linux > 5.0 ********************************************************************** make. Copy 'pam_radius_auth.so' to /lib/security/pam_radius_auth.so In the per-application configuration (/etc/pam.d/application) add: auth sufficient /lib/security/pam_radius_auth.so AFTER auth required /lib/security/pam_securetty.so and BEFORE auth required /lib/security/pam_unix_auth.so i.e. auth required /lib/security/pam_securetty.so auth sufficient /lib/security/pam_radius_auth.so auth required /lib/security/pam_unix_auth.so My linux is RedHat 9, so this part pertains to my machine : "Redhat Linux > 5.0" "make. Copy 'pam_radius_auth.so' to /lib/security/pam_radius_auth.so" - already did... "In the per-application configuration (/etc/pam.d/application) add:" - I want to use pam radius to authenticate ssh logins, so "(/etc/pam.d/application)" becomes "/etc/pam.d/sshd" "auth required pam_securetty.so auth sufficient pam_radius_auth.so debug auth required /lib/security/pam_unix_auth.so" -this part from INSTALL is identical to my /etc/pam.d/sshd...all of this modules deal with authentication ("auth"). pam_securetty verifies if root can login through tty by reading /etc/securetty. "required" means that this step is mandatory and that after this verification, the next authentication method will take place. this is where pam_radius_auth comes. the messages are exchanged as explained in my my previuos e-mail. "sufficient" means that if this authentication succeeds, the following authentication methods will not be checked...in other terms: "auth required /lib/security/pam_unix_auth.so" will be passed. I don't understand why you are saying that "you are invoking pam_radius_auth in the wrong place and for the wrong reason"...please, be more specific and if you know the right configuration, enlight me! Again, any help would be appreciated! > >Hi, > >> anyone??? pls!!! no suggestions at all ? :( > >I'd read the INSTALL doc that coems as part of the pam_radius >tool. > >> > - cat /etc/pam.d/sshd >> >#%PAM-1.0 >> >auth required pam_securetty.so >> >auth sufficient pam_radius_auth.so debug >> >auth required /lib/security/pam_unix_auth.so >> >account required pam_radius_auth.so debug >> >password required pam_stack.so service=system-auth >> >session required pam_stack.so service=system-auth >> >session required pam_limits.so >> >session optional pam_console.so > >no. your invoking pam_radius_auth in the wrong place and for the wrong reason. >again the INSTALL is your friend. > > >your radius configuration appears to be correct > >alan >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

IPPOOL only give me two ip´s. HELP
by Paloma Munoz 17 Oct '06

17 Oct '06

Hello to all! I have a problem about the ippool. My pool only give me two ip´s.(More than one user have the same ip) I use freeradius version 1.0.1 in Red Hat EL4 with mysql I see in other messagess this problem and someone says that the problem comes to NAS-port. My Radius always give me the same port. I change the format of the port in the Cisco: Data format(bits): slot(4), module(1), port(3), vpi(8), vci(16) and now the port change from 0 to 538837024 (but always the same). In the Access-Request the NAS send the NAS-port ,the NAS-IP-Address and NAS-Identifier -------radiusd -X ----------------------------------------------------------- rad_recv: Access-Request packet from host 212.230.0.207:1645, id=52, length=132 Framed-Protocol = PPP User-Name = "user1" User-Password = "xxxxx" NAS-Port-Type = Virtual Cisco-NAS-Port = "2/0/0/30.32" NAS-Port = 538837024 Service-Type = Framed-User NAS-IP-Address = 212.230.0.207 Acct-Session-Id = "2/0/0/30.32_020033AD" NAS-Identifier = "ATM_sp_mad_C03" Login OK: [user1/xxxxxx] (from client ATM_sp_mad_C03 port 538837024) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 7 rlm_ippool: Searching for an entry for nas/port: 212.230.0.207/538837024 rlm_ippool: Searching for an entry for nas/port: 212.230.0.207/538837024 rlm_ippool: Allocating ip to nas/port: 212.230.0.207/538837024 rlm_ippool: num: 1 rlm_ippool: Allocated ip 192.168.1.232 to client on nas 212.230.0.207,port 538837024 modcall[post-auth]: module "dynamic" returns ok for request 7 ------------------------------------------------------------------- How can I do that the NAS send a diferent port for each user? Is this posible? Are there some option in the configuration file of the radius? Now, all the requests has the same NAS-port Also, i read that i can modify the file rlm_ippool with other attibute, but i dont know a lot of programming and i need other solution. Please, help me, I don´t Know what can I do more. Thank you for all Regards Paloma

1 0

SNMP with Freeradius
by Velikanov 17 Oct '06

17 Oct '06

Good Day. I want to use SNMP with Freeradius. I have: 1.FreeRADIUS Version 1.1.3, for host, configured with option '-with-snmp' In src/include/autoconf.h I see: /* Include SNMP subagent */ /* #undef WITH_SNMP */ #define HAVE_UCD_SNMP_ASN1_SNMP_SNMPIMPL_H 1 /* #undef HAVE_ASN1_SNMP_SNMPIMPL_H */ /* #undef HAVE_LIBSNMP */ 2.Red Hat Linux v.3.3; 2.6.9-34.EL 3.net-snmp-5.1.2-11.EL4.6 configured with option '--with-mib-modules=host agentx smux ucd-snmp/lmSensors' radiusd.conf, snmp.conf, snmpd.conf - where configured as in docs and in http://wiki.freeradius.org/SNMP_HOWTO when I run /usr/local/sbin/radiusd -X there are no strings with "smux", as shown in wiki Where is my mistake? Thanks.

2 1

new attribute-value in replies of radius
by igalatoczki＠contactnet.hu 17 Oct '06

17 Oct '06

Hi All! I should like to add new attribute-value pair to the authentication replies of the freeradius server. The present content of authentication reply package: Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 Framed-MTU = 2000 Framed-Compression = Van-Jacobson-TCP-IP Port-Limit = 1 Reply-Message = "any" The content of the radreply mysql table: ID USERNAME ATTRIBUTE OP VALUE 1 testuser Framed-Protocol = PPP 2 testuser Framed-IP-Netmask = 255.255.255.255 3 testuser Framed-MTU = 2000 4 testuser Framed-Compression = Van-Jacobson-TCP-IP 5 testuser Port-Limit = 1 6 testuser Reply-Message = any I try add new attribute to dictionary file and radreply table: row of the directory file: ATTRIBUTE Test-Attr 1081 integer row of the radreply table: 7 testuser Test-Attr = 1234 But is it not work. The authentication reply not changed. Is it Possible I add new attribute to radius reply? If yes, how can I it? Steve

1 0

RE: SNMP with Freeradius
by Kshitij Korde 17 Oct '06

17 Oct '06

Hi When you configure free radius with option 3.net-snmp-5.1.2-11.EL4.6 configured with option '--with-mib-modules=host agentx smux ucd-snmp/lmSensors' See the output , verify whether it asks for some snmp files, if it says like snmp.c ---> no That might be the culprit Regards Ravi -----Original Message----- From: freeradius-users-bounces+kshitijk=techmahindra.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+kshitijk=techmahindra.com@lists.freerad ius.org] On Behalf Of Velikanov Sent: Tuesday, October 17, 2006 3:43 PM To: freeradius-users(a)lists.freeradius.org Subject: SNMP with Freeradius Good Day. I want to use SNMP with Freeradius. I have: 1.FreeRADIUS Version 1.1.3, for host, configured with option '-with-snmp' In src/include/autoconf.h I see: /* Include SNMP subagent */ /* #undef WITH_SNMP */ #define HAVE_UCD_SNMP_ASN1_SNMP_SNMPIMPL_H 1 /* #undef HAVE_ASN1_SNMP_SNMPIMPL_H */ /* #undef HAVE_LIBSNMP */ 2.Red Hat Linux v.3.3; 2.6.9-34.EL 3.net-snmp-5.1.2-11.EL4.6 configured with option '--with-mib-modules=host agentx smux ucd-snmp/lmSensors' radiusd.conf, snmp.conf, snmpd.conf - where configured as in docs and in http://wiki.freeradius.org/SNMP_HOWTO when I run /usr/local/sbin/radiusd -X there are no strings with "smux", as shown in wiki Where is my mistake? Thanks. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ============================================================================================================================ Tech Mahindra, formerly Mahindra-British Telecom. Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

1 0

sqlippool + MySQL
by Roberto Gonzalez Azevedo 17 Oct '06

17 Oct '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Does somebody knows how to configure sqlippool with MySQL ? The sqlippool.conf example is for pgsql. And for MySQL ? Here is my sqlippool.conf, corrected for MySQL: " sqlippool sqlippool { # # SQL connection information # sql-instance-name = "sql" # lease_duration. fix for lost acc-stop packets lease-duration = 3600 # Attribute which should be considered unique per NAS pool-key = "%{Acct-Session-Id}" pool-name = "mypool" # pool-key = "%{Calling-Station-Id}" # # This series of queries allocates an IP address # allocate-clear = "UPDATE radippool \ SET NASIPAddress = '', pool_key = 0, CallingStationId = '', \ expiry_time = NOW() - INTERVAL 1 SECOND \ WHERE pool_key = '${pool-key}'" # note the ORDER BY clause of next query, it'll try to allocate IPs # like Cisco internal pools do - it _trys_ to allocate the same IP-address # which user had last session... allocate-find = "SELECT FramedIPAddress FROM radippool \ WHERE pool_name = '%{reply:Pool-Name}' AND expiry_time < NOW() \ ORDER BY pool_name, (UserName <> '%{User-Name}'), (CallingStationId <> '%{Calling-Station-Id}'), expiry_time \ LIMIT 1 \ FOR UPDATE" allocate-update = "UPDATE radippool \ SET NASIPAddress = '%{NAS-IP-Address}', pool_key = '${pool-key}', \ CallingStationId = '%{Calling-Station-Id}', UserName = '%{User-Name}', \ expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ WHERE FramedIPAddress = '%{Framed-IP-Address}'" # # This series of queries frees an IP number when an accounting # START record arrives # start-update = "UPDATE radippool \ SET expiry_time = NOW() + INTERVAL %J SECOND \ WHERE NASIPAddress = '%n' AND pool_key = '${pool-key}' AND pool_name = '%P'" # # This series of queries frees an IP number when an accounting # STOP record arrives # stop-clear = "UPDATE radippool \ SET NASIPAddress = '', pool_key = 0, CallingStationId = '', \ expiry_time = NOW() - INTERVAL 1 SECOND \ WHERE NASIPAddress = '%{NAS-IP-Address}' AND pool_key = '${pool-key}' AND UserName = '%{User-Name}' \ AND CallingStationId = '%{Calling-Station-Id}' AND FramedIPAddress = '%{Framed-IP-Address}'" # # This series of queries frees an IP number when an accounting # ALIVE record arrives # alive-update = "UPDATE radippool \ SET expiry_time = NOW() + INTERVAL ${lease-duration} SECOND \ WHERE NASIPAddress = '%{Nas-IP-Address}' AND pool_key = '${pool-key}' AND UserName = '%{User-Name}' \ AND CallingStationId = '%{Calling-Station-Id}' AND FramedIPAddress = '%{Framed-IP-Address}'" # # This series of queries frees the IP numbers allocate to a # NAS when an accounting ON record arrives # on-clear = "UPDATE radippool \ SET NASIPAddress = '', pool_key = 0, CallingStationId = '', \ expiry_time = NOW() - INTERVAL 1 SECOND \ WHERE NASIPAddress = '%{NAS-IP-Address}' AND UserName = '%{User-Name}' \ AND CallingStationId = '%{Calling-Station-Id}' AND FramedIPAddress = '%{Framed-IP-Address}'" # # This series of queries frees the IP numbers allocate to a # NAS when an accounting OFF record arrives # off-clear = "UPDATE radippool \ SET NASIPAddress = '', pool_key = 0, CallingStationId = '', \ expiry_time = NOW() - INTERVAL 1 SECOND \ WHERE NASIPAddress = '%{NAS-IP-Address}' AND UserName = '%{User-Name}' \ AND CallingStationId = '%{Calling-Station-Id}' AND FramedIPAddress = '%{Framed-IP-Address}'" } " Here is the radiusd -X: " ... Mon Oct 16 17:50:50 2006 : Debug: Processing the post-auth section of radiusd.conf Mon Oct 16 17:50:50 2006 : Debug: modcall: entering group post-auth for request 0 Mon Oct 16 17:50:50 2006 : Debug: modsingle[post-auth]: calling sqlippool (rlm_sqlippool) for request 0 Mon Oct 16 17:50:50 2006 : Debug: rlm_sqlippool: Framed-IP-Address already exists Mon Oct 16 17:50:50 2006 : Debug: modsingle[post-auth]: returned from sqlippool (rlm_sqlippool) for request 0 Mon Oct 16 17:50:50 2006 : Debug: modcall[post-auth]: module "sqlippool" returns noop for request 0 Mon Oct 16 17:50:50 2006 : Debug: modcall: leaving group post-auth (returns noop) for request 0 ... ... Mon Oct 16 17:50:50 2006 : Debug: modsingle[accounting]: calling sqlippool (rlm_sqlippool) for request 1 Mon Oct 16 17:50:50 2006 : Debug: rlm_sql (sql): Reserving sql socket id: 2 Mon Oct 16 17:50:50 2006 : Debug: radius_xlat: 'BEGIN' Mon Oct 16 17:50:50 2006 : Debug: radius_xlat: 'UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE NASIPAddress = 'xx.xx.xx.xx' AND pool_key = '4533F0AA608100' AND pool_name = 'sqlippool'' ... " This 'update' will never match !!! Here is the radippool's current line: " mysql> select * from radippool; +----+-----------+-----------------+--------------+-----------------+------------------+---------------------+----------+----------+ | id | pool_name | FramedIPAddress | NASIPAddress | CalledStationId | CallingStationId | expiry_time | UserName | pool_key | +----+-----------+-----------------+--------------+-----------------+------------------+---------------------+----------+----------+ | 1 | mypool | 192.168.0.1 | | | | 0000-00-00 00:00:00 | | | +----+-----------+-----------------+--------------+-----------------+------------------+---------------------+----------+----------+ 1 row in set (0.00 sec) " In radgroupcheck: " In (mysql) radgroupcheck : +-----+-------------------+------------------+----+-------------+------+ | id | GroupName | Attribute | op | Value | prio | +-----+-------------------+------------------+----+-------------+------+ | 39 | mygroup | Pool-Name | := | mypool | 1 | ... " Thanks. - -- - ---------------------------- Roberto Gonzalez Azevedo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFFM/aEF+EMwkXLsEwRAsmvAKC5gV8xZN8g4gxZwrdpVQi7eTCzHgCdEfNn 1O0G6WtRGvyLBter1vtzQSk= =z+5W -----END PGP SIGNATURE-----

4 3

Unresponsive child problem
by Christophe Saillard 17 Oct '06

17 Oct '06

Hi, We use Freeradius to authenticate users on our Wireless Network with EAP-TTLS/PAP. Users credentials are stored in an Openldap directory. We use a FreeBSD 6.1 for both Openldap (version 2.3.21) and Freeradius (version 1.1.3) servers. Here's the problem : Sometimes Freeradius seems to freeze, by the way nobody can authenticate. When the problem happens we always get this kind of logs : ---------------------------------------------------------------------------------------------- Mon Oct 16 14:37:55 2006 : Error: WARNING: Unresponsive child (id 138254336) for request 193144 Mon Oct 16 14:37:56 2006 : Auth: Login OK: [anonymous] (from client wds1 port 81519 cli 0012.f085.47b6) Mon Oct 16 14:37:56 2006 : Auth: Login incorrect (rlm_ldap: User not found): [mitschi] (from client localhost port 226570 cli 0016.cbf6.f173) Mon Oct 16 14:37:56 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Mon Oct 16 14:37:56 2006 : Auth: Login incorrect: [anonymous] (from client wds3 port 385187 cli 0013.027d.7685) Mon Oct 16 14:37:57 2006 : Info: rlm_radutmp: Login entry for NAS sceco-ap10 port 5125 duplicate Mon Oct 16 14:37:57 2006 : Error: WARNING: Unresponsive child (id 142451200) for request 193148 Mon Oct 16 14:37:57 2006 : Auth: Login incorrect: [anonymous] (from client wds4 port 226570 cli 0016.cbf6.f173) Mon Oct 16 14:37:57 2006 : Error: WARNING: Unresponsive child (id 141391360) for request 193161 Mon Oct 16 14:37:58 2006 : Error: WARNING: Unresponsive child (id 136836608) for request 193160 Mon Oct 16 14:37:58 2006 : Error: WARNING: Unresponsive child (id 142492672) for request 193168 Mon Oct 16 14:37:58 2006 : Error: TLS Alert write:fatal:bad record mac Mon Oct 16 14:37:58 2006 : Error: TLS_accept:error in SSLv3 read certificate verify A Mon Oct 16 14:37:58 2006 : Error: rlm_eap: SSL error error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac Mon Oct 16 14:37:58 2006 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Mon Oct 16 14:37:58 2006 : Error: WARNING: Unresponsive child (id 143504384) for request 193170 Mon Oct 16 14:37:58 2006 : Error: WARNING: Unresponsive child (id 136609280) for request 193169 Mon Oct 16 14:37:58 2006 : Error: TLS Alert write:fatal:bad record mac Mon Oct 16 14:37:58 2006 : Error: TLS_accept:error in SSLv3 read certificate verify A Mon Oct 16 14:37:58 2006 : Error: rlm_eap: SSL error error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac Mon Oct 16 14:37:58 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Oct 16 14:37:58 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Mon Oct 16 14:37:58 2006 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Mon Oct 16 14:37:58 2006 : Auth: Login incorrect: [anonymous] (from client wds1 port 81519 cli 0012.f085.47b6) Mon Oct 16 14:37:59 2006 : Error: Discarding duplicate request from client wds3:1645 - ID: 60 due to unfinished request 193267 Mon Oct 16 14:38:00 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Mon Oct 16 14:38:00 2006 : Auth: Login incorrect: [anonymous] (from client wds3 port 385200 cli 0016.6f1d.95ab) Mon Oct 16 14:38:00 2006 : Error: WARNING: Unresponsive child (id 138869248) for request 193183 Mon Oct 16 14:38:00 2006 : Error: rlm_radutmp: Logout for NAS eost-ap8 port 30871, but no Login record Mon Oct 16 14:38:00 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Mon Oct 16 14:38:00 2006 : Auth: Login incorrect: [anonymous] (from client wds4 port 226570 cli 0016.cbf6.f173) Mon Oct 16 14:38:00 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Mon Oct 16 14:38:00 2006 : Auth: Login incorrect: [anonymous] (from client wds4 port 226571 cli 0012.f084.8584) Mon Oct 16 14:38:01 2006 : Info: rlm_radutmp: Login entry for NAS atrium-ap4 port 2330 duplicate Mon Oct 16 14:38:01 2006 : Error: WARNING: Unresponsive child (id 143503360) for request 193188 Mon Oct 16 14:38:02 2006 : Error: WARNING: Unresponsive child (id 141392384) for request 193192 Mon Oct 16 14:38:03 2006 : Error: WARNING: Unresponsive child (id 138870272) for request 193201 Mon Oct 16 14:38:03 2006 : Error: WARNING: Unresponsive child (id 138002944) for request 193191 Mon Oct 16 14:38:03 2006 : Error: WARNING: Unresponsive child (id 141391872) for request 193194 Mon Oct 16 14:38:03 2006 : Error: WARNING: Unresponsive child (id 138741248) for request 193193 Mon Oct 16 14:38:03 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Oct 16 14:38:03 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Oct 16 14:38:05 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Oct 16 14:38:05 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Oct 16 14:38:06 2006 : Error: WARNING: Unresponsive child (id 143275008) for request 193217 Mon Oct 16 14:38:06 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Oct 16 14:38:06 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Oct 16 14:38:07 2006 : Error: WARNING: Unresponsive child (id 137878528) for request 193208 Mon Oct 16 14:38:07 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Oct 16 14:38:07 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Oct 16 14:38:07 2006 : Error: WARNING: Unresponsive child (id 136836096) for request 193230 Mon Oct 16 14:38:07 2006 : Error: Discarding duplicate request from client wds3:1645 - ID: 67 due to unfinished request 193295 Mon Oct 16 14:38:08 2006 : Info: rlm_radutmp: Login entry for NAS eost-ap7 port 4634 duplicate Mon Oct 16 14:38:09 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Oct 16 14:38:09 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Oct 16 14:38:09 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Oct 16 14:38:09 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Oct 16 14:38:09 2006 : Error: WARNING: Unresponsive child (id 135813632) for request 193228 Mon Oct 16 14:38:09 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Oct 16 14:38:09 2006 : Auth: Login OK: [4struluc] (from client localhost port 385199 cli 0013.ce16.6432) Mon Oct 16 14:38:09 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Oct 16 14:38:09 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Oct 16 14:38:10 2006 : Error: WARNING: Unresponsive child (id 137993216) for request 193231 Mon Oct 16 14:38:10 2006 : Error: WARNING: Unresponsive child (id 137992192) for request 193235 Mon Oct 16 14:38:10 2006 : Error: WARNING: Unresponsive child (id 137992704) for request 193233 Mon Oct 16 14:38:10 2006 : Auth: Login OK: [anonymous] (from client wds3 port 385199 cli 0013.ce16.6432) Mon Oct 16 14:38:11 2006 : Error: WARNING: Unresponsive child (id 141528064) for request 193237 Mon Oct 16 14:38:11 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Mon Oct 16 14:38:11 2006 : Auth: Login incorrect: [anonymous] (from client wds3 port 385201 cli 0013.0212.0e66) Mon Oct 16 14:38:11 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Oct 16 14:38:11 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Oct 16 14:38:12 2006 : Error: WARNING: Unresponsive child (id 139014144) for request 193239 Mon Oct 16 14:38:13 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Mon Oct 16 14:38:13 2006 : Auth: Login incorrect: [anonymous] (from client wds3 port 385199 cli 0013.ce16.6432) Mon Oct 16 14:38:13 2006 : Error: WARNING: Unresponsive child (id 138217472) for request 193241 Mon Oct 16 14:38:14 2006 : Error: WARNING: Unresponsive child (id 142135808) for request 193250 Mon Oct 16 14:38:15 2006 : Error: WARNING: Unresponsive child (id 135814144) for request 193252 Mon Oct 16 14:38:16 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Oct 16 14:38:16 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Oct 16 14:38:17 2006 : Error: WARNING: Unresponsive child (id 138721280) for request 193258 Mon Oct 16 14:38:18 2006 : Info: rlm_radutmp: Login entry for NAS eost-ap7 port 4634 duplicate Mon Oct 16 14:38:19 2006 : Error: Discarding duplicate request from client wds4:1645 - ID: 140 due to unfinished request 193328 Mon Oct 16 14:38:19 2006 : Error: WARNING: Unresponsive child (id 139077632) for request 193262 Mon Oct 16 14:38:20 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Oct 16 14:38:21 2006 : Error: WARNING: Unresponsive child (id 138864128) for request 193264 Mon Oct 16 14:38:21 2006 : Error: rlm_radutmp: Login entry for NAS sceco-ap10 port 5125 wrong order Mon Oct 16 14:38:21 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Oct 16 14:38:22 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Oct 16 14:38:22 2006 : Error: TLS Alert write:fatal:bad record mac Mon Oct 16 14:38:22 2006 : Error: TLS_accept:error in SSLv3 read certificate verify A Mon Oct 16 14:38:22 2006 : Error: rlm_eap: SSL error error:0407106B:rsa routines:RSA_padding_check_PKCS1_type_2:block type is not 02 Mon Oct 16 14:38:22 2006 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Mon Oct 16 14:38:23 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Oct 16 14:38:23 2006 : Error: WARNING: Unresponsive child (id 136606720) for request 193269 Mon Oct 16 14:38:23 2006 : Error: WARNING: Unresponsive child (id 138504704) for request 193266 Mon Oct 16 14:38:23 2006 : Error: WARNING: Unresponsive child (id 137850880) for request 193274 Mon Oct 16 14:38:23 2006 : Error: Discarding duplicate request from client wds3:1645 - ID: 74 due to unfinished request 193334 Mon Oct 16 14:38:24 2006 : Error: TLS Alert write:fatal:bad record mac Mon Oct 16 14:38:24 2006 : Error: TLS_accept:error in SSLv3 read certificate verify A Mon Oct 16 14:38:24 2006 : Error: rlm_eap: SSL error error:1408F455:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac Mon Oct 16 14:38:24 2006 : Error: rlm_radutmp: Login entry for NAS atrium-ap4 port 2330 wrong order Mon Oct 16 14:38:24 2006 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Mon Oct 16 14:38:25 2006 : Error: rlm_radutmp: Login entry for NAS sceco-ap10 port 5125 wrong order Mon Oct 16 14:38:25 2006 : Auth: Login OK: [cwang] (from client localhost port 385201 cli 0013.0212.0e66) Mon Oct 16 14:38:25 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Mon Oct 16 14:38:25 2006 : Auth: Login incorrect: [anonymous] (from client wds6 port 38777 cli 0013.cedc.d1b9) Mon Oct 16 14:38:25 2006 : Error: rlm_radutmp: Logout for NAS sceco-ap10 port 5125, but no Login record Mon Oct 16 14:38:26 2006 : Info: rlm_radutmp: Login entry for NAS dpt-info-ap5 port 618 duplicate Mon Oct 16 14:38:26 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Mon Oct 16 14:38:26 2006 : Auth: Login incorrect: [anonymous] (from client wds3 port 385204 cli 0015.0046.7656) Mon Oct 16 14:38:26 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Mon Oct 16 14:38:26 2006 : Auth: Login incorrect: [anonymous] (from client wds4 port 226564 cli 0009.5b95.74a3) Mon Oct 16 14:38:27 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Mon Oct 16 14:38:27 2006 : Auth: Login incorrect: [anonymous] (from client wds4 port 226578 cli 0013.02be.2994) Mon Oct 16 14:38:27 2006 : Error: TLS_accept:error in SSLv3 read client certificate A ---------------------------------------------------------------------------------------------- The only way to get authentication working is to kill and restart Freeradius. Here's the ldap configuration for freeradius : ldap LDAP_OSIRIS { server = "ldap://bton.u-strasbg.fr" basedn = "ou=personnes,o=osiris" filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusProfileWifi=*))" start_tls = no profile_attribute = radiusProfileWifi dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 20 password_attribute = userPassword groupname_attribute = radiusGroupNameWifi groupmembership_filter = (uid=%{Stripped-User-Name:-%{User-Name}}) timeout = 7 timelimit = 3 net_timeout = 1 } When we get the "Unresponsive child" messages the server doesn't seem to be very busy ... strange. The ldap server is only used by Freeradius ... Any ideas ? -- --------------------------- Christophe Saillard Centre Réseau Communication Université Louis Pasteur --------------------------- Tél : 03 90 24 03 17 Fax : 03 90 24 03 12 ---------------------------

2 1

Re: WPA authentication works only with MacOS clients
by Jason Wittlin-Cohen 17 Oct '06

17 Oct '06

Message: 5 Date: Mon, 16 Oct 2006 22:36:14 +0200 From: "Josh Shamir" <josh.shamir(a)gmail.com> Subject: Re: WPA authentication works only with MacOS clients To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <8b3d60af0610161336k20473a1cw4410cbaa6eda17c7(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" "Hi Jason, I want to use PEAP. So I can use PEAP on a WinXP SP2 client without any other supplicant, using his native supplicant. The problem is that with native WinXP supplicant the authentication process failed, and freeradius server give me an error regarding certificates. The strange thing is that with the same certificates, PEAP works fine with MacOSx. Could be a problem of certificates ? I generate certificates with CA.all. Any ideas about how generate certificates that works also with MS WixXP client?" This is a common problem. Windows XP requires that the server and client certificates have specific attributes. This is useful as it prevents a main-in-the-middle attack where an authentic client masquerades as a server with his client cert. You need to use Microsoft's Extended Attributes: [ xpclient_ext] extendedKeyUsage = 1.3.6.1.5.5.7.3.2 [ xpserver_ext ] extendedKeyUsage = 1.3.6.1.5.5.7.3.1 See http://www.linuxjournal.com/node/8095/print for detailed instructions how to create a server certificate that will work with PEAP and MS clients. The HOWTO is for EAP-TLS which requires client and server certificates. Since you are using PEAP, you just need to create the server certificate. Good luck. In particular you'll want to do: openssl req -new -keyout server_key.pem -out server_req.pem -days 730 -config ./openssl.cnf openssl ca -config ./openssl.cnf \ -policy policy_anything -out server_cert.pem \ -extensions xpserver_ext -extfile ./xpextensions \ -infiles ./server_req.pem You'll now have server_cert.pem (Public Certificate) and server_key.pem (Private Key which has no password). The public certificate will have the Server extended key usage extensions set and now your XP client should authenticate.

2 1

RE: [sec: unclas] Huntgroupname checkitem in LDAP
by Jonathan De Graeve 17 Oct '06

17 Oct '06

> Van: freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org] Namens Ranner, > Frank MR > Verzonden: dinsdag 17 oktober 2006 4:17 > Aan: FreeRadius users mailing list > Onderwerp: RE: [sec: unclas] Huntgroupname checkitem in LDAP > > > DEFAULT Ldap-Group == `%{Huntgroup-Name}` > Access-Level := RW, > Service-Type = Administrative-User, > Cisco-AVPair := "shell:priv-lvl=15", > Passport-Command-Impact = configuration > Although this approach Works if you just want to add attributes for a certain huntgroup if a user is member of it. My problem is, I have 2 user databases, one being SQL the other being LDAP/AD I want to be able to specify to which NASses the LDAP/AD user has access too. If it were only LDAP/AD users, everything would work like this: DEFAULT Ldap-Group == `%{Huntgroup-Name}` Fall-Through = no DEFAULT Auth-Type := REJECT In this way, every user that is not a member of a specific Group that matches a Huntgroup name is denied access. But I still have the SQL users and the above rules breaks them. So I changed it to this: DEFAULT SQL-Group == `%{Huntgroup-Name}` Fall-Through = no DEFAULT Ldap-Group == `%{Huntgroup-Name}` Fall-Through = no DEFAULT Auth-Type := REJECT In this way, I need to change my SQL users setup from instead having the Huntgroup-Name in SQL as a checkitem (radgroupcheck) to add every SQL user to a SQL-group having the same name as the huntgroup. This behaviour works but is not really desirable. After searching and experimenting the trick to NOT break EAP/LDAP/SQL but still having everything working like I wanted it to be was just as follows: DEFAULT Ldap-Group == `%{Huntgroup-Name}` Fall-Through = no DEFAULT Auth-Type = LOCAL Fall-Through = Yes This configuration allows for the default SQL behaviour to stay the same, having EAP AND locking Ldap users to the NASes controlled by there groupmembership. Since I spent a long time figuring this out I wanted to share this to the list. My current setup has SQL users + Complete Active Directory integration (having EAP=>NTLM) + LDAP(PAP/etc...) Kind Regards, J.

1 0