October 2006 - Freeradius-Users - lists.freeradius.org

Re: disable FreeRadius checking of client certs
by devel 10 Oct '06

10 Oct '06

Thanks guys for your post. First off, I have tried using the WinXP supplicant and I have no problems authenticating with the Linksys wifi cards. I just wish the Linksys utility was like Cisco where I can tell it do provide either/or username/cert. The Cisco cards have no problem with this as where using the Linksys with its utility does not provide me with what I want. No big deal. Using the Linksys client utitliy, a username, password, and certificate must be provided (the certificate is a combo box so I can't even leave it blank). I have always preferred to use the utility that came with wifi cards for configuration. They typically provide more information and are more user friendly than the Windows supplicant. This problem does pertain to the Linksys software more than FreeRadius. I was just hoping there was a way in the FreeRadius config files to help solve the problem Travis ----- Original Message ----- From: "Artur Hecker" <artur(a)wave-storm.com> To: "devel" <devel(a)oberonwireless.com>; "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, October 10, 2006 12:42 PM Subject: Re: disable FreeRadius checking of client certs > Hi Travis > > > Excuse me for top-posting, but just as Alan I'm a bit surprised by your > post. > > If your authentication system is based on certificates, you need > certificates and you really should not say anything like "certificates > bother me" since that is the only expression of your trust, so without > that verification no authentication will ever be reasonable or complete. > > If it is not, you do not have certificates. Allowing both for the same > client (same machine) is discouraged. Personally I am not familar with a > supplicant which tries one and then another for the same username. > > Thus, per user if you are using EAP-PEAP-MSCHAPv2 (passwords), then you > are not using EAP-TLS. And vice versa. > > The good news is: the authentication method has strictly nothing to do > with the WiFi card; it is completely virtualized, in software. EAP is > only a transporter protocol, it does not say how to authenticate, it only > says how to transport data. Thus, if EAP is supported by the card, then > *every* EAP method is supported. That's magic about 802.1X and that's why > it's supported in the operating system rather than being supported by a > network card. > > Now if you are saying that you use a special Linksys 802.1X client, then > I would first suggest that you use the standard WinXP client. Sorry, but > the Linksys client is fairly unknown. > > Practically, it's difficult to guess from what you provided, but I think > that you do use the WinXP supplicant (i.e. 802.1X client - I do not know > of any linksys supplicant) and that you probably want to use > EAP-PEAP-MSCHAPv2. That involves one server certificate (obviously one > common trust anker - a self signed CA certificate) and some > username/passwords on clients. What probably happened is that in the two > cases where the Linksys card is used, you did not correctly configure > EAP-PEAP (called "Protected EAP" in WinXP or similar), but you let it be > "Smartcard or Certificate". Thus, the card tries to do TLS with some > available pub/priv key combination, but Freeradius rejects it. > > Reconfigure the WinXP supplicant to do EAP-PEAP and it will ask you for > passwords. Do not forget to deploy the server certificate on user > machines... > > >> Well, I have not issued certs to clients. Some of my clients have the >> option to log in with a username "OR" a cert. However, there are a few >> random Linksys cards (I guess I should have mentioned this was for >> Wifi/WPA) that I "MUST" provide a username and a cert. > > Strictly speaking, every EAP session will take a Username and the AAA > server will derive from it the authentication method to use. When used in > EAP-TLS, Windows XP typically fills it out with the CN from the > certificate (if available) but that is of course insufficient and it > would be more correct to give an identifier and then to start a TLS > authentication session for that id. (How exactly the username compares to > the certified information is an open question, since the username can be > altered by different means). > > >> If there are no certs on the client machine, Linksys fills the cert in >> with "Trust Any", so I assume it may be attempting with a blank? cert or >> another cert on the machine, such as VeriSign or the like.So this client >> is attempting to authenticate, I believe, with other certs on its >> machine because the radius log looks like below: > > hmmm??? you can't just use any certificate for authentication. What you > need is a pair: certificate/private key. Nobody except Verisign has their > private key. > > The only option for your Linksys 802.1X client would be to spontaneously > create a CA and to issue one user certificate for EAP authentication > signed by the latter. That can be done by XP, but there is no interest in > doing so. > > I would suggest you deploy passwords on these machines and configure EAP > PEAP. > > > regards > artur > > >> Tue Oct 10 11:16:16 2006 : Error: TLS_accept:error in SSLv3 read >> client certificate A >> Tue Oct 10 11:16:16 2006 : Error: rlm_eap: SSL error error: >> 00000000:lib(0):func(0):reason(0) >> Tue Oct 10 11:16:16 2006 : Error: TLS Alert read:fatal:unknown CA >> Tue Oct 10 11:16:16 2006 : Error: TLS_accept:failed in SSLv3 read >> client certificate A >> Tue Oct 10 11:16:16 2006 : Error: rlm_eap: SSL error error: >> 14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca >> Tue Oct 10 11:16:16 2006 : Error: rlm_eap_tls: SSL_read failed inside >> of TLS (-1), TLS session fails. >> Tue Oct 10 11:16:16 2006 : Error: rlm_eap: SSL error error: >> 140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure >> Tue Oct 10 11:16:16 2006 : Error: rlm_eap_tls: BIO_read failed in a >> system call (-1), TLS session fails. >> >> I am not a FreeRadius expert so I may be misinterpreting the logs. >> Thanks. >> >> >> Travis >> ----- Original Message ----- From: "Alan DeKok" >> <aland(a)deployingradius.com> >> To: "devel" <devel(a)oberonwireless.com>; "FreeRadius users mailing list" >> <freeradius-users(a)lists.freeradius.org> >> Sent: Tuesday, October 10, 2006 10:27 AM >> Subject: Re: disable FreeRadius checking of client certs >> >> >>> "devel" <devel(a)oberonwireless.com> wrote: >>>> Is it possible to disable FreeRadius's checking of client certificates >>>> using EAP-TLS-PEAP? Certs can be quick a bother and a huge maintenance >>>> over-head. Thanks. >>> >>> Huh? Client certs are used for PEAP only when you deploy client >>> certs to the end-user machines. Once they're deployed, they should >>> really be checked. >>> >>> Perhasp you can explain why you've deployed client certs, but now >>> don't want to use them. >>> >>> Alan DeKok. >>> -- >>> http://deployingradius.com - The web site of the book >>> http://deployingradius.com/blog/ - The blog >>> >> >> - List info/subscribe/unsubscribe? See http://www.freeradius.org/ >> list/users.html > >

1 0

cisco-accounting do not work. what i miss?
by Paloma Munoz 10 Oct '06

10 Oct '06

Hello to all! I have a problem with the accounting. I have FreeRADIUS Version 1.0.1 I think i have all I need to make the accounting but do not work. When I use the: "Radius Test Client", all is OK, i can see the log in mysql table(radacct)and in detail log file, but in the NAS don´t work. The authentication and authorization work ok. The Ip is assigned from the Radius. Also the "postauth logs" in mysql, works ok. ---------My cisco configuration---------------- aaa group server radius pal server A.B.C.D auth-port 1645 acct-port 1646 ! aaa authentication ppp default group pal aaa authorization network default group pal aaa accounting delay-start aaa accounting update newinfo aaa accounting network default start-stop group pal interface Virtual-Template2 ip unnumbered ATM2/0 ppp authentication pap radius-server configure-nas radius-server host A.B.C.D auth-port 1645 acct-port 1646 radius-server retransmit 2 radius-server timeout 20 radius-server key -------------------------------- ----my RADIUS configuration---- radiusd.conf: accounting { detail radutmp pool sql} ------------------------------- Any idea, where is the problem? I do not know, what is it happens Thanks for all

1 0

disable FreeRadius checking of client certs
by devel 10 Oct '06

10 Oct '06

Is it possible to disable FreeRadius's checking of client certificates using EAP-TLS-PEAP? Certs can be quick a bother and a huge maintenance over-head. Thanks. FreeRadius 1.1.3 Travis J. Weaver Software Engineer Oberon, Inc. 1315 S. Allen St. Suite 405 State College, PA 16801 phone: (814)867-2312 ext. 210 fax: (814)867-2314 http://www.oberonwireless.com tjw(a)oberonwireless.com

2 3

One connection per username
by Ali Jawad 09 Oct '06

09 Oct '06

Hi How can I limit one connection per username..I.e. I do not want to allow multiple users to login using the same username password combination. -- With Regards Ali Jawad

2 1

Reversibly encrypted passwords in SQL
by Stefan Winter 09 Oct '06

09 Oct '06

Hello, is there any way of using reversibly encrypted passwords together with a mySQL backend? Currently, our passwords are stored as User-Password in clear text. I'd like to move on to using something like Crypt-Password := {algo-prefix}blablabla with an algorithm that encrypts reversibly. I failed to see a list of supported algorithms in the docs, a pointer would be nice... Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

4 4

RE: EAP-TLS Certificate problems.
by Jason-Wittlin-Cohen 09 Oct '06

09 Oct '06

> Message: 7 > Date: Mon, 9 Oct 2006 11:26:51 -0400 > From: "Brian vb" <nova5radius(a)gmail.com> > Subject: RE: EAP-TLS Certificate problems. > To: "'FreeRadius users mailing list'" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <000f01c6ebb7$59118220$be01010a@lightwave> > Content-Type: text/plain; charset="us-ascii" > > Recreated certs, same issue came with the Issuer field. XPExtensions are > used. Password is the same in this file an what Freeradius has just changed > to protect it. > > > Here is the batch file I'm using to create the certs. I don't see anything > amiss between it and the page you sent.. any ideas? > > > PATH=C:\openssl\bin;C:\ssl1;%path% > export LD_LIBRARY_PATH=C:\openssl\lib > > > CD\SSL1 > > REM CA Creation > C:\openssl\bin\openssl req -new -x509 -keyout newreq.pem -out newreq.pem > -days 730 -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl pkcs12 -export -in newreq.pem -out root.p12 -cacerts > -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl pkcs12 -in root.p12 -out root.pem -passin > pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl x509 -inform PEM -outform DER -in root.pem -out > root.der I'm not sure what you're doing here. First, "> C:\openssl\bin\openssl req -new -x509 -keyout newreq.pem -out newreq.pem > -days 730 -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved" You're outputting the private key and public key to the same file. I'm not sure if this will include both in the same file, or only create one. Regardless, it's not what you want to do. Give the files unique names. The clients and server need the public key and only the certificate signing machine needs the private key. You don't want to combine the keys. To create a CA: openssl req -new -x509 -keyout private/cakey.pem -out cacert.pem -days 365 -config openssl.cnf Also, why are you creating a p12 file for the CA? You certainly don't want to hand out the private key to clients, and for certificate signing, you only need the private key which can be stored in cakey.pem for example. Clients should be given cacert.pem or cacert.der depending on the format you use. The p12 format should only be used for client certs because those need to combine private key + certificate (at least for the MS supplicant). > > REM Client cert Create > C:\openssl\bin\openssl req -new -keyout newreq.pem -out newreq.pem -days 730 > -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved Again, -keyout is used to creaate the private key, and -out to create the certificate signing request which is then passed on to the CA later. You're using the same filename, so I have no idea what's happening. Either you have a certificate signing request and no key, or a key without a signing request. Either way, it won't work. You need to do something like this: openssl req -new -keyout client_key.pem \ -out client_req.pem -days 730 -config ./openssl.cnf Notice that the key and the signing request are given different names. > > C:\openssl\bin\openssl ca -policy policy_anything -out newcert.pem -passin > pass:PassCodeRemoved -key PassCodeRemoved -extensions xpclient_ext -extfile > xpexts -infiles newreq.pem > > C:\openssl\bin\openssl pkcs12 -export -in newcert.pem -inkey newreq.pem -out > cert-clt.p12 -clcerts -passin pass:PassCodeRemoved -passout > pass:PassCodeRemoved > > C:\openssl\bin\openssl pkcs12 -in cert-clt.p12 -out cert-clt.pem -passin > pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl x509 -inform PEM -outform DER -in cert-clt.pem -out > cert-clt.der So, you convert from a PEM certificate and PEM key, to a P12 cert+key, to a PEM cert+key to DER cert+key. Why? The P12 cert+key will work fine. > > REM Server Cert Create > C:\openssl\bin\openssl req -new -keyout newreq.pem -out newreq.pem -days 730 > -passin pass:PassCodeRemoved -passout pass:PassCodeRemoved Again, the key and certificate signing request must be given different names or else your setup will fail. > > C:\openssl\bin\openssl ca -policy policy_anything -out newcert.pem -passin > pass:PassCodeRemoved -key PassCodeRemoved -extensions xpserver_ext -extfile > xpexts -infiles newreq.pem > Do you need these steps? Freeradius will use a seperate certificate and key in PEM format. It works fine for me. It seems like your setup is overly complex. Keep it simple, and see if it works. Then you can change file formats- etc. For now, just make the changes I recommended and see if it gives you a working CA and client/server certificates. > C:\openssl\bin\openssl pkcs12 -export -in newcert.pem -inkey newreq.pem -out > cert-srv.p12 -clcerts -passin pass:PassCodeRemoved -passout > pass:PassCodeRemoved > > C:\openssl\bin\openssl pkcs12 -in cert-srv.p12 -out cert-srv.pem -passin > pass:PassCodeRemoved -passout pass:PassCodeRemoved > > C:\openssl\bin\openssl x509 -inform PEM -outform DER -in cert-srv.pem -out > cert-srv.der > Jason Wittlin-Cohen

1 0

Huntgroups, Realms, MySQL
by Brad McAllister 09 Oct '06

09 Oct '06

Sorry if this has already been addressed. I has been searching all day and haven't found the solution to my problem. I am attempting to setup multiple huntgroups to limit the types of connections that clients can make. Along with this I have a list of realms that are authenticated locally and others that are directed to remote radius servers. All of the user and group information is stored in a mysql db. I am having problems authenticating users with realms that are not passed to a remote server. Below is an example of a test without a realm: radtest test blah123 127.0.0.1 0 testing123Sending Access-Request of id 215 to 127.0.0.1:1812 User-Name = "test" User-Password = "blah123" NAS-IP-Address = localhost.localdomain NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=215, length=272 Framed-Protocol = PPP Framed-Routing = Broadcast Framed-Compression = None Framed-MTU = 1500 Idle-Timeout = 0 Cisco-AVPair = "lcp:interface-config=rate-limit input 256000 32000 32000 conform-action transmit exceed-action drop" Cisco-AVPair = "lcp:interface-config=rate-limit output 4500000 32000 32000 conform-action transmit exceed-action drop" Service-Type = Framed-User With a realm: radtest test(a)dls.net blah123 127.0.0.1 0 testing123 Sending Access-Request of id 223 to 127.0.0.1:1812 User-Name = "test(a)dls.net" User-Password = "blah123" NAS-IP-Address = localhost.localdomain NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=223, length=20 Output from the server: rad_recv: Access-Request packet from host 127.0.0.1:32770, id=223, length=77 User-Name = "test(a)dls.net" User-Password = "blah123" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 rlm_sql (sql): - sql_groupcmp radius_xlat: 'test(a)dls.net' rlm_sql (sql): sql_set_user escaped user --> 'test(a)dls.net' radius_xlat: 'SELECT GroupName FROM usergroup WHERE UserName='test(a)dls.net'' rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 rlm_sql (sql): - sql_groupcmp finished: User does not belong in group 3072BY256 No huntgroup access: [test(a)dls.net] (from client localhost port 0) modcall[authorize]: module "preprocess" returns reject for request 2 modcall: group authorize returns reject for request 2 If I removed the huntgroups out of the picture, is works fine. The problem seems to be that the realm is not being stripped off of the username when it checks it against the usergroup table. If more information is needed, please let me know. I would really like to get this working. Thanks! - Brad

2 5

Debian stableFreeradius 1.0.2 + IOdbc + FreeTDS + MSSQL Segmentation fault.
by Angelo Compagnucci 09 Oct '06

09 Oct '06

Hi to all! I've a GREAT problem ... Freeradius exits abnormally with a segmentation fault error when user logoff ... This is the log: ... Processing the preacct section of radiusd.conf modcall: entering group preacct for request 2 modcall[preacct]: module "preprocess" returns noop for request 2 rlm_acct_unique: Hashing 'NAS-Port = 45,Client-IP-Address = 192.168.0.2,NAS-IP-Address = 192.168.0.2,Acct-Session-Id = "81700000",User-Name = "tester6"' rlm_acct_unique: Acct-Unique-Session-ID = "14ec0af158f89db2". modcall[preacct]: module "acct_unique" returns ok for request 2 modcall: leaving group preacct (returns ok) for request 2 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 2 radius_xlat: '/var/log/radius/radutmp' radius_xlat: 'tester6' modcall[accounting]: module "radutmp" returns ok for request 2 radius_xlat: 'tester6' rlm_sql (sql): sql_set_user escaped user --> 'tester6' radius_xlat: 'UPDATE radacct SET AcctStopTime = '2006-10-09 16:28:21', AcctSessionTime = '5', AcctInputOctets = '96', AcctOutputOctets = '200', AcctTerminateCause = 'User-Request', AcctStopDelay = '0', ConnectInfo_stop = '' WHERE AcctSessionId = '81700000' AND UserName = 'tester6' AND NASIPAddress = '192.168.0.2' AND AcctStopTime = 0' rlm_sql (sql): Reserving sql socket id: 1 Segmentation fault --------------- This is the strace: time(NULL) = 1160408543 getsockname(4, {sa_family=AF_INET, sin_port=htons(1813), sin_addr=inet_addr("0.0.0.0")}, [23053941335916560]) = 0 recvmsg(4, {msg_name(16)={sa_family=AF_INET, sin_port=htons(1035), sin_addr=inet_addr("192.168.0.2")}, msg_iov(1)=[{"\4 [\0\302\362n\337zq`9\211\335\320@^\n\307\360\214\6\6"..., 4096}], msg_controllen=32, {cmsg_len=28, cmsg_level=SOL_IP, cmsg_type=, ...}, msg_flags=0}, 0) = 194 write(1, "rad_recv: Accounting-Request pac"..., 82rad_recv: Accounting-Request packet from host 192.168.0.2:1035, id=91, length=194 ) = 82 time(NULL) = 1160408543 write(1, "\tService-Type = Framed-User\n", 28 Service-Type = Framed-User ) = 28 write(1, "\tFramed-Protocol = PPP\n", 23 Framed-Protocol = PPP ) = 23 write(1, "\tNAS-Port = 47\n", 15 NAS-Port = 47 ) = 15 write(1, "\tNAS-Port-Type = Ethernet\n", 26 NAS-Port-Type = Ethernet ) = 26 write(1, "\tUser-Name = \"tester6\"\n", 23 User-Name = "tester6" ) = 23 write(1, "\tCalling-Station-Id = \"00:02:3F:"..., 42 Calling-Station-Id = "00:02:3F:17:65:34" ) = 42 write(1, "\tCalled-Station-Id = \"service1\"\n", 32 Called-Station-Id = "service1" ) = 32 write(1, "\tNAS-Port-Id = \"ether1\"\n", 24 NAS-Port-Id = "ether1" ) = 24 write(1, "\tAcct-Session-Id = \"81800001\"\n", 30 Acct-Session-Id = "81800001" ) = 30 write(1, "\tFramed-IP-Address = 10.0.102.17"..., 34 Framed-IP-Address = 10.0.102.175 ) = 34 write(1, "\tFramed-IP-Netmask = 255.255.255"..., 35 Framed-IP-Netmask = 255.255.255.0 ) = 35 write(1, "\tAcct-Authentic = RADIUS\n", 25 Acct-Authentic = RADIUS ) = 25 write(1, "\tAcct-Session-Time = 5\n", 23 Acct-Session-Time = 5 ) = 23 write(1, "\tAcct-Input-Octets = 96\n", 24 Acct-Input-Octets = 96 ) = 24 write(1, "\tAcct-Input-Gigawords = 0\n", 26 Acct-Input-Gigawords = 0 ) = 26 write(1, "\tAcct-Input-Packets = 9\n", 24 Acct-Input-Packets = 9 ) = 24 write(1, "\tAcct-Output-Octets = 200\n", 26 Acct-Output-Octets = 200 ) = 26 write(1, "\tAcct-Output-Gigawords = 0\n", 27 Acct-Output-Gigawords = 0 ) = 27 write(1, "\tAcct-Output-Packets = 11\n", 26 Acct-Output-Packets = 11 ) = 26 write(1, "\tAcct-Status-Type = Stop\n", 25 Acct-Status-Type = Stop ) = 25 write(1, "\tAcct-Terminate-Cause = User-Req"..., 37 Acct-Terminate-Cause = User-Request ) = 37 write(1, "\tNAS-Identifier = \"MikroTik\"\n", 29 NAS-Identifier = "MikroTik" ) = 29 write(1, "\tNAS-IP-Address = 192.168.0.2\n", 30 NAS-IP-Address = 192.168.0.2 ) = 30 write(1, "\tAcct-Delay-Time = 0\n", 21 Acct-Delay-Time = 0 ) = 21 time(NULL) = 1160408543 write(1, " Processing the preacct section"..., 49 Processing the preacct section of radiusd.conf ) = 49 time(NULL) = 1160408543 write(1, "modcall: entering group preacct "..., 46modcall: entering group preacct for request 2 ) = 46 time(NULL) = 1160408543 write(1, " modcall[preacct]: module \"prep"..., 67 modcall[preacct]: module "preprocess" returns noop for request 2 ) = 67 time(NULL) = 1160408543 write(1, "rlm_acct_unique: Hashing \'NAS-Po"..., 153rlm_acct_unique: Hashing 'NAS-Port = 47,Client-IP-Address = 192.168.0.2,NAS-IP-Address = 192.168.0.2,Acct-Session-Id = "81800001",User-Name = "tester6"' ) = 153 time(NULL) = 1160408543 write(1, "rlm_acct_unique: Acct-Unique-Ses"..., 62rlm_acct_unique: Acct-Unique-Session-ID = "8132fc6445e0c224". ) = 62 time(NULL) = 1160408543 write(1, " modcall[preacct]: module \"acct"..., 66 modcall[preacct]: module "acct_unique" returns ok for request 2 ) = 66 time(NULL) = 1160408543 write(1, "modcall: leaving group preacct ("..., 58modcall: leaving group preacct (returns ok) for request 2 ) = 58 time(NULL) = 1160408543 write(1, " Processing the accounting sect"..., 52 Processing the accounting section of radiusd.conf ) = 52 time(NULL) = 1160408543 write(1, "modcall: entering group accounti"..., 49modcall: entering group accounting for request 2 ) = 49 time([1160408543]) = 1160408543 time(NULL) = 1160408543 write(1, "radius_xlat: \'/var/log/radius/r"..., 40radius_xlat: '/var/log/radius/radutmp' ) = 40 time(NULL) = 1160408543 write(1, "radius_xlat: \'tester6\'\n", 24radius_xlat: 'tester6' ) = 24 open("/var/log/radius/radutmp", O_RDWR|O_CREAT, 0600) = 11 fcntl(11, F_SETLKW, {type=F_WRLCK, whence=SEEK_CUR, start=0, len=112}) = 0 lseek(11, 6944, SEEK_SET) = 6944 read(11, "tester6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 112) = 112 lseek(11, -112, SEEK_CUR) = 6944 write(11, "tester6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 112) = 112 close(11) = 0 time(NULL) = 1160408543 write(1, " modcall[accounting]: module \"r"..., 65 modcall[accounting]: module "radutmp" returns ok for request 2 ) = 65 time(NULL) = 1160408543 write(1, "radius_xlat: \'tester6\'\n", 24radius_xlat: 'tester6' ) = 24 time(NULL) = 1160408543 write(1, "rlm_sql (sql): sql_set_user esca"..., 55rlm_sql (sql): sql_set_user escaped user --> 'tester6' ) = 55 stat("/etc/localtime", {st_mode=S_IFREG|0644, st_size=951, ...}) = 0 time(NULL) = 1160408543 write(1, "radius_xlat: \'UPDATE radacct SE"..., 338radius_xlat: 'UPDATE radacct SET AcctStopTime = '2006-10-09 17:42:23', AcctSessionTime = '5', AcctInputOctets = '96', AcctOutputOctets = '200', AcctTerminateCause = 'User-Request', AcctStopDelay = '0', ConnectInfo_stop = '' WHERE AcctSessionId = '81800001' AND UserName = 'tester6' AND NASIPAddress = '192.168.0.2' AND AcctStopTime = 0' ) = 338 time(NULL) = 1160408543 write(1, "rlm_sql (sql): Reserving sql soc"..., 42rlm_sql (sql): Reserving sql socket id: 1 ) = 42 time(NULL) = 1160408543 select(7, NULL, [6], NULL, NULL) = 1 (out [6]) sendto(6, "\1\1\1I\0\0\0\0UPDATE radacct SET AcctS"..., 329, MSG_NOSIGNAL, NULL, 0) = 329 time(NULL) = 1160408543 select(7, [6], NULL, NULL, NULL) = 1 (in [6]) recvfrom(6, "\4\1\0\21\0007\1\0", 8, MSG_NOSIGNAL, NULL, NULL) = 8 time(NULL) = 1160408543 time(NULL) = 1160408543 select(7, [6], NULL, NULL, NULL) = 1 (in [6]) recvfrom(6, "\375\20\0\305\0\1\0\0\0", 9, MSG_NOSIGNAL, NULL, NULL) = 9 time(NULL) = 1160408543 --- SIGSEGV (Segmentation fault) @ 0 (0) --- +++ killed by SIGSEGV +++ Process 3981 detached

1 0

RE: EAP-TLS Certificate problems.
by Jason Wittlin-Cohen 09 Oct '06

09 Oct '06

> Hi, I'm trying to get Freeradius up and running on a WinXP box (win haters. > be nice ;) ) I have downloaded, installed, and configured the Freeradius > version from www.freeradius.net. The server starts seemingly without errors. > However when I try to connect with my XP laptop I get a certificate error on > the radius systems log. I have created 3 certificates, Root, Client, Server. > The Root and Client certificates were installed via the MMC snapin and > Import wizard in XP. Any idea on what could be causing the errors? If I > need to post file contents, let me know which ones. Using EAP-TLS(cert > based) not EAP-TTLS(user-pass based). Xp laptop is stuck at "Attempting to > Authenticate." > Welcome to the Freeradius mailing list, and thank you for providing debug log to help us sort out this issue. The debug information will tell you exactly why it's being rejected (i.e. no certificate was sent, certificate was signed by another CA). I believe I know what's going wrong. The CA public cert should be stored in the "Trusted Root Certification Authorities" certificate store. If it's anywhere else, Windows won't authenticate the server and it will look like it's failing- when it's doing what you asked it to do. In this scenario you won't see any error output from Freeradius because Windows has stopped attempting to connect. Your user public certificate must be stored in either your User or Machine Account "Personal" Certificate store (this is the first option in the snap-in). Also, if you have more than one certificate in your personal store, do not use "simply certificate selection". Windows will choose the one highest in the list (It did for me). Manually select the certificate you want to use. Read this howto and follow the "Configuring Windows XP Clients" guide. It will tell you exactly what to do. See http://www.linuxjournal.com/node/8151/print Here is what's happening currently: > Error 1 is seen if I have Validate Server Certificate check on the XP > Laptop. > > --Error 1-- > Sat Oct 7 19:35:58 2006 : Error: TLS_accept:error in SSLv3 read client > certificate A > ------ > > When you enable Server verification, Windows checks to see if the server's certificate is signed by a trusted Root CA that you specify. Since you didn't install the CA to the "Trusted Root Certificate Authorities" certificate store, the Windows supplicant refuses to continue authenticating and Freeradius has nothing to do. This error doesn't actually mean anything. I see it when I have a successful login. You're not seeing an error- which means the problem is on the client side. This can be remedied by installing your Root CA in the "Trusted Root Certification Authorities" certificate store. Here's a successful authenticaiton from my radiusd.log. You'll notice the read client certificate A error. It can safely be ignored. Sun Oct 8 03:13:56 2006 : Error: TLS_accept:error in SSLv3 read client certificate A Sun Oct 8 03:13:56 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Sun Oct 8 03:13:56 2006 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Sun Oct 8 03:13:56 2006 : Auth: Login OK: [Jason Wittlin-Cohen] (from client WLAN port 8 cli 00095b93459e) > Error 2 is seen if Validate is unchecked on the laptop > > --Error 2-- > Sat Oct 7 19:34:35 2006 : Error: TLS_accept:error in SSLv3 read client > certificate A > Sat Oct 7 19:34:35 2006 : Error: --> verify error:num=20:unable to get > local issuer certificate > Sat Oct 7 19:34:35 2006 : Error: TLS Alert write:fatal:unknown CA > Sat Oct 7 19:34:35 2006 : Error: TLS_accept:error in SSLv3 read client > certificate B > Sat Oct 7 19:34:35 2006 : Error: rlm_eap_tls: SSL_read failed in a system > call (-1), TLS session fails. > Sat Oct 7 19:34:35 2006 : Auth: Login incorrect: [shadowwolf/<no > User-Password attribute>] (from client netnas port 11 cli 0014a5104864) > ----- > > Error 2 tells us exactly what the problem is. "Unable to get local issuer certificate" AND "Unknown CA". In other words, the certificate used is not the one it should be using as it's signed by another CA. This can be remedied by either installing the correct certificate in the "Personal" user certificate store and turning off "simple certificate selection". I hope this resolves your problem. Jason Wittlin-Cohen

2 3

free radius ntlm_auth problem
by Alan DeKok 09 Oct '06

09 Oct '06

Andris wrote: ... > Usernames without whitespaces authorize succesfully. When > run ntlm_auth manal and write usernames like 'user 1' than work. And > i want put a NT group requirment too like a 'Domain Users' ntlm_auth > string is: > > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} > --challenge=%{mschap:Challenge:-00} > --nt-response=%{mschap:NT-Response:-00}" Try using: ntlm_auth = '...', i.e. use single quotes rather than double quotes. The issue appears to be that the User-Name string is expanded *before* the 'exec program' code is being called. That means the splitting of the program arguments by spaces is hitting the space in the username. What *should* happen is that entire string gets sent to the 'exec program' code, which splits the string by spaces, and *then* expands User-Name. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

2 2