February 2006 - Freeradius-Users - lists.freeradius.org

sqlcounter design for prepaid
by Rusma 09 Feb '06

09 Feb '06

dear all, I need your advice for my prepaid billing, i have several scenario : 1. prepaid for 4 hours and expire in 2 days after login. 2. prepaid for 8 hours and expire in 4 days after login. 3. prepaid for 24 hours and expire in 1 day. i have configured my freeradius and mysql using rlm_sqlcounter, i have tested with sample account from sqlcounter doc and its works. . i need to make or change default scripts for above schemes. can any body help me. best regards, rusma permana

1 1

PEAP with sql - plain Identity
by Norbert Grochal 09 Feb '06

09 Feb '06

In 'Ralink Wireless Utility' -> '802.1x Setting' I can choose 'PEAP' and foll 3 fields (with my example values): 1. Identyty = myidentyty 2. Login = mylogin 3. Password = mypass (I set protocol as EAP-MSCHAP v2) in freeradius users file I can write: mylogin Auth-Type = EAP, User-Password := "mypassword" So identity can by any word. I hope mylogin and mypassword is sent to radius encrypted, not as plain text. But when I clear the users file and use sql I have a recerd in radcheck table: id UserName Attribute op Value ... (other fields) 1 mylogin User-Password == mypassword ... (other values) and in "Ralink...' I MUST (?) set (Identity = Login = mylogin) and Password = mypassword to be authorized in freeradius. But isn't Identity sent as clear text ??? I want to set Identity as Client Name, not as his login, is it possible? SQL queries check User-Name attribute and *I don't know how* put it to rlm_eap_peap and it says: Tunneled data is valid. (...) Success. But I don't want to login be equals to identity... Norbert

2 3

User passwords in 127.0.0.1/auth-detail file
by Walter Reynolds 09 Feb '06

09 Feb '06

I am currently running freeradius 1.0.4 I have the following line set log_auth_goodpass = no I am also using krb5 module under PAM. The problem I am having is while I do not get the User-Password in the <NAS>/auth-detail log, it does show up in the 127.0.0.1/auth-detail file. I have tried to search the archive and feel I must me mising something. Can someone please help me figure out what is going on? I want logs and details, just not the user passwords. Thanks. -- Walter Reynolds University of Michigan

2 1

freeradius-1.1.0 and make error
by Hubert Kupper 09 Feb '06

09 Feb '06

Hello, I try to compile freeradius-1.1.0 on suse 10.0 64bit. ./configure --with-edir comes without errors. When I try make the following error occours: "/usr/lib/libltdl.so: xould not read symbols: File in wrong format" Can anyone help? Regards Hubert

2 1

freeradius v 1.1.0 segmentation fault,,help....
by tommy garsia 09 Feb '06

09 Feb '06

Hi all, i've installed freeradius with experimental modules enabled under debian sarge... after i run the program by typing hotspot:# radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded SQL Counter Module: Instantiated sqlcounter (noresetcounter) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded SQL Segmentation fault (core dumped) then i check using gdb like this (gdb) run -x Starting program: /usr/local/sbin/radiusd -x [Thread debugging using libthread_db enabled] [New Thread 1075661280 (LWP 18090)] Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded SQL Counter Module: Instantiated sqlcounter (noresetcounter) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded SQL Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 1075661280 (LWP 18090)] 0x400640df in lt_dlsym (handle=0x81171e8, symbol=0x8115738 "rlm_sql_mysql") at ltdl.c:3330 3330 lensym = LT_STRLEN (symbol) + LT_STRLEN (handle->loader->sym_prefix) what should i do with the module??is the anything wrong with my configuration?? or anything else?? the compilation may be?? best regards, tommy --------------------------------- Brings words and photos together (easily) with PhotoMail - it's free and works with Yahoo! Mail.

2 1

cannot connect to mysql
by Rusma 09 Feb '06

09 Feb '06

dear all, im a newbie, i have configured freeradius + mysql, but i can't connect user from radcheck table. please give me an advices, etc/rc.d/rc.radiusd restart Starting FreeRADIUS:Thu Feb 9 10:51:54 2006 : Info: Starting - reading configuration files ... radiusd [root@Customercare raddb]# tail -f /usr/local/var/log/radius/radius.log Thu Feb 9 10:51:54 2006 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Thu Feb 9 10:51:54 2006 : Info: rlm_sql (sql): Attempting to connect to hidden Thu Feb 9 10:51:54 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Thu Feb 9 10:51:54 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Thu Feb 9 10:51:54 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Thu Feb 9 10:51:54 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Thu Feb 9 10:51:54 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Thu Feb 9 10:51:54 2006 : Info: Ready to process requests. table radcheck 150;"test0001";"Max-All-Session";":=";"54000";"0000-00-00 00:00:00";"NULL";;0;"0000-00-00 00:00:00";0;1 152;"test0001";"User-Password";":=";"test88";"0000-00-00 00:00:00";"NULL";;0;"0000-00-00 00:00:00";0;1 [root@Customercare raddb]# radtest test0001 test88 127.0.0.1 1812 testing123 Sending Access-Request of id 30 to 127.0.0.1 port 1812 User-Name = "test0001" User-Password = "test88" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Re-sending Access-Request of id 30 to 127.0.0.1 port 1812 User-Name = "test0001" User-Password = "test88" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=30, length=2 [root@Customercare raddb]# tail -f /usr/local/var/log/radius/radius.log Thu Feb 9 11:01:01 2006 : Auth: Login incorrect: [test0001/test88] (from client localhost port 1812) Thu Feb 9 11:07:01 2006 : Auth: Login incorrect: [test0001/test88] (from client localhost port 1812) any idea ..? best regards, rusma permana

2 2

A simple clients,Users and naslist
by Radius User 09 Feb '06

09 Feb '06

I am totally a newbie at the world of freeradius. Can any one give me a simple example clients,users and naslists file. so simply...... regards

2 1

integrate with other protocol
by Priscilla B 08 Feb '06

08 Feb '06

Hallo everyone, I have a short question, Is it possible for other protocol to integrate it with freeradius? This protocol is run by a deamon and I want to send the result of this process as access request (that will forwarded by NAS to server) this is what I thought, do you think it is possible? Is there any library that I can use to extend this function? Thanks a lot folks, Pris __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

fast auth time with EAP_TLS?
by Andrea G Forte 08 Feb '06

08 Feb '06

Dear all, I have setup a RADIUS server (freeradius of course) with an authenticator (hostapd 0.4.7) and a supplicant (wpa_supplicant 0.4.7). Both the last two use hostap-driver 0.4.7. I am using EAP-TLS (client and server certificates generated by the CA.all script included in freeradius) with RSN (CCMP). I am not sure if something is wrong in the authentication process. The problem is that it is taking too little time for the authentication process to complete. In the attached file you can see one authentication process captured using kismet and then parsed with Ethereal. As you cane see the time from Assoc. resp to the first encrypted data packet is only 222 msec. About a year ago it was of the order of one second (and all the literature says so). Has WPA2 improved the authentication time so much? Am I doing something wrong in setting up EAP-TLS? Your help is very much appreciated. Thank you, Andrea No. Time Source Destination Protocol Info 3037 10.711982 LinksysG_18:f4:9d LinksysG_15:ab:62 IEEE 802.11 Probe Response, SSID: "test" Frame 3037 (73 bytes on wire, 73 bytes captured) IEEE 802.11 IEEE 802.11 wireless LAN management frame No. Time Source Destination Protocol Info 3060 10.774339 LinksysG_18:f4:9d LinksysG_15:ab:62 IEEE 802.11 Probe Response, SSID: "test" Frame 3060 (73 bytes on wire, 73 bytes captured) IEEE 802.11 IEEE 802.11 wireless LAN management frame No. Time Source Destination Protocol Info 3061 10.777773 LinksysG_18:f4:9d LinksysG_15:ab:62 IEEE 802.11 Probe Response, SSID: "test" Frame 3061 (73 bytes on wire, 73 bytes captured) IEEE 802.11 IEEE 802.11 wireless LAN management frame No. Time Source Destination Protocol Info 3062 10.782807 LinksysG_18:f4:9d LinksysG_15:ab:62 IEEE 802.11 Probe Response, SSID: "test" Frame 3062 (73 bytes on wire, 73 bytes captured) IEEE 802.11 IEEE 802.11 wireless LAN management frame No. Time Source Destination Protocol Info 3091 10.927769 LinksysG_15:ab:62 LinksysG_18:f4:9d IEEE 802.11 Authentication Frame 3091 (30 bytes on wire, 30 bytes captured) IEEE 802.11 IEEE 802.11 wireless LAN management frame No. Time Source Destination Protocol Info 3093 10.929806 LinksysG_18:f4:9d LinksysG_15:ab:62 IEEE 802.11 Authentication Frame 3093 (30 bytes on wire, 30 bytes captured) IEEE 802.11 IEEE 802.11 wireless LAN management frame No. Time Source Destination Protocol Info 3095 10.930709 LinksysG_15:ab:62 LinksysG_18:f4:9d IEEE 802.11 Association Request, SSID: "test" Frame 3095 (62 bytes on wire, 62 bytes captured) IEEE 802.11 IEEE 802.11 wireless LAN management frame No. Time Source Destination Protocol Info 3098 10.932869 LinksysG_18:f4:9d LinksysG_15:ab:62 IEEE 802.11 Association Response Frame 3098 (36 bytes on wire, 36 bytes captured) IEEE 802.11 IEEE 802.11 wireless LAN management frame No. Time Source Destination Protocol Info 3107 10.970317 LinksysG_18:f4:9d LinksysG_15:ab:62 EAP Request, Identity [RFC3748] Frame 3107 (46 bytes on wire, 46 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3111 10.983395 LinksysG_18:f4:9d LinksysG_15:ab:62 EAP Request, EAP-TLS [RFC2716] [Aboba] Frame 3111 (42 bytes on wire, 42 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3118 11.017082 LinksysG_15:ab:62 LinksysG_18:f4:9d TLS Client Hello Frame 3118 (142 bytes on wire, 142 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3122 11.027284 LinksysG_18:f4:9d LinksysG_15:ab:62 TLS Server Hello, Certificate, Certificate Request, Server Hello Done Frame 3122 (1070 bytes on wire, 1070 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3124 11.032757 LinksysG_15:ab:62 LinksysG_18:f4:9d EAP Response, EAP-TLS [RFC2716] [Aboba] Frame 3124 (42 bytes on wire, 42 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3127 11.038553 LinksysG_18:f4:9d LinksysG_15:ab:62 TLS Server Hello, Certificate, Certificate Request, Server Hello Done Frame 3127 (483 bytes on wire, 483 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3131 11.059361 LinksysG_15:ab:62 LinksysG_18:f4:9d TLS Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message Frame 3131 (1444 bytes on wire, 1444 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3138 11.081295 LinksysG_18:f4:9d LinksysG_15:ab:62 EAP Request, EAP-TLS [RFC2716] [Aboba] Frame 3138 (42 bytes on wire, 42 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3140 11.083268 LinksysG_15:ab:62 LinksysG_18:f4:9d TLS Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message Frame 3140 (308 bytes on wire, 308 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3149 11.094655 LinksysG_18:f4:9d LinksysG_15:ab:62 TLS Change Cipher Spec, Encrypted Handshake Message Frame 3149 (105 bytes on wire, 105 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3151 11.103162 LinksysG_15:ab:62 LinksysG_18:f4:9d EAP Response, EAP-TLS [RFC2716] [Aboba] Frame 3151 (42 bytes on wire, 42 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3154 11.106911 LinksysG_18:f4:9d LinksysG_15:ab:62 EAP Success Frame 3154 (40 bytes on wire, 40 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3156 11.107979 LinksysG_18:f4:9d LinksysG_15:ab:62 EAPOL Key Frame 3156 (131 bytes on wire, 131 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3160 11.116155 LinksysG_15:ab:62 LinksysG_18:f4:9d EAPOL Key Frame 3160 (153 bytes on wire, 153 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3162 11.123636 LinksysG_18:f4:9d LinksysG_15:ab:62 EAPOL Key Frame 3162 (187 bytes on wire, 187 bytes captured) IEEE 802.11 Logical-Link Control 802.1x Authentication No. Time Source Destination Protocol Info 3195 11.154024 LinksysG_15:ab:62 LinksysG_18:f4:9d IEEE 802.11 Data Frame 3195 (79 bytes on wire, 79 bytes captured) IEEE 802.11 Data (47 bytes) 0000 ac 81 63 5f 1f 6b 2b ca c9 f2 db 37 5d 74 fc 18 ..c_.k+....7]t.. 0010 94 44 ac 48 4a f5 1b 57 97 63 4c ef 07 57 22 02 .D.HJ..W.cL..W". 0020 7c 65 5a cd 66 6b ca 5c c3 83 da c5 9d 40 ca |eZ.fk.\.....@. No. Time Source Destination Protocol Info 3196 11.154749 LinksysG_15:ab:62 LinksysG_18:f4:9d IEEE 802.11 Data Frame 3196 (79 bytes on wire, 79 bytes captured) IEEE 802.11 Data (47 bytes) 0000 ac 81 63 5f 1f 6b 2b ca c9 f2 db 37 5d 74 fc 18 ..c_.k+....7]t.. 0010 94 44 ac 48 4a f5 1b 57 97 63 4c ef 07 57 22 02 .D.HJ..W.cL..W". 0020 7c 65 5a cd 66 6b ca 5c c3 83 da c5 9d 40 ca |eZ.fk.\.....@. No. Time Source Destination Protocol Info 3197 11.157232 LinksysG_15:ab:62 LinksysG_18:f4:9d IEEE 802.11 Data Frame 3197 (79 bytes on wire, 79 bytes captured) IEEE 802.11 Data (47 bytes) 0000 ac 81 63 5f 1f 6b 2b ca c9 f2 db 37 5d 74 fc 18 ..c_.k+....7]t.. 0010 94 44 ac 48 4a f5 1b 57 97 63 4c ef 07 57 22 02 .D.HJ..W.cL..W". 0020 7c 65 5a cd 66 6b ca 5c c3 83 da c5 9d 40 ca |eZ.fk.\.....@. No. Time Source Destination Protocol Info 3198 11.172835 LinksysG_15:ab:62 LinksysG_18:f4:9d IEEE 802.11 Data Frame 3198 (79 bytes on wire, 79 bytes captured) IEEE 802.11 Data (47 bytes) 0000 1d 51 9a 06 06 80 33 80 dc d1 aa 9b 3b c7 c5 b6 .Q....3.....;... 0010 3c c8 5b ec 78 af a8 0d f1 ba 0f f8 a5 a7 b2 50 <.[.x..........P 0020 03 e6 1f e8 0f e5 66 f5 5b 9d 11 de 99 b8 b3 ......f.[...... No. Time Source Destination Protocol Info 3212 11.192806 LinksysG_15:ab:62 LinksysG_18:f4:9d IEEE 802.11 Data Frame 3212 (79 bytes on wire, 79 bytes captured) IEEE 802.11 Data (47 bytes) 0000 b3 bb a4 d0 7a eb 53 51 55 39 93 18 fa 83 2d 21 ....z.SQU9....-! 0010 85 9d 55 a3 eb 9f 93 7d b7 9e 72 04 ee 49 ef 0b ..U....}..r..I.. 0020 8d 62 f9 54 d0 b9 85 02 87 f2 e8 36 6e 76 ee .b.T.......6nv.

2 3

FreeRADIUS w/ TKIP, PEAP, EAP, MS-CHAP v2 - relocation error
by John Metcalfe 08 Feb '06

08 Feb '06

We are using FreeRADIUS version 1.0.2 with OpenSSL version 0.96. The client supplicant is WinXP SP2 with WPA TKIP, PEAP and EAP MS-CHAP v2 configured. The NAS is a Symbol WS5100 WLAN switch configured to use RADIUS, TKIP and PEAP. We configured RADIUS and it starts (in debug mode) and we are able login to the server with test client software using raduser and shared secret password. On the XP client we are able to enter credentials (raduser and shared secret) and the Symbol switch receives and forwards the request to the RADIUS server with the following error in the switch log file: "failed 802.1x authentication for BSS " Then RADIUS stops with the following error: radiusd: relocation error: /usr/lib/freeradius/rlm_eap_tls-1.0.2.so: undefined symbol: SSL_set_msg_callback We understand that the version of openSSL may be out of date but we can't upgrade due to other issues and dependancies. Any help or suggestions is greatly appreciated. Below is the complete startup in debug mode with error listed above at the end. Thanks again. John ========== Complete RADIUS startup below ======================== rad_recv: Access-Request packet from host 10.203.10.51:10369, id=123, length=140 User-Name = "raduser" NAS-IP-Address = 10.203.10.51 Called-Station-Id = "00:A0:F8:6E:1E:10" Calling-Station-Id = "00:05:4E:4F:2B:23" NAS-Identifier = "swdevlab_5100_1" NAS-Port = 29 Framed-MTU = 1000 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000c0172616475736572 Message-Authenticator = 0xabd78f651fd43d26ca7a7707c1a4f402 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "raduser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry raduser at line 75 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls radiusd: relocation error: /usr/lib/freeradius/rlm_eap_tls-1.0.2.so: undefined symbol: SSL_set_msg_callback ========================== end ================================= John Metcalfe, Jr. IT Specialist - AIS IBM Business Consulting Services, Public Sector Telephone: 240-396-5305 email: metcalfej(a)us.ibm.com

2 1