March 2006 - Freeradius-Users - lists.freeradius.org

EAP-TTLS
by Santiago Balaguer García 06 Mar '06

06 Mar '06

Hi people, When I configure eap.conf file and re-launch ./radiusd -X appears: ***************************** rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "/usr/local/etc/raddb/certs/demoCA/" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = yes tls: check_cert_cn = "%{User-Name}" rlm_eap: Loaded and initialized type tls Segmentation default <----------------------ERROR --------------- *********************************** Is it necessary to recompile freeradius source to active EAP-TTLS? Anyway, I read all doc/ about this topic. I am very lucky if someone recomends me links to get more information about these protocol. _________________________________________________________________ Descubre la descarga digital con MSN Music. Más de un millón de canciones. http://music.msn.es/

2 1

proxy problem/question
by VannMann32 . 06 Mar '06

06 Mar '06

Hi ! I'm trying to set up a freeradius (1.1.0) server to proxy ms-chap-v2 to a ms ias server. If I send ms-chap, then the proxy works. But if I send ms-chap-v2 then i get this error message (from debug) : Sending Access-Request of id 1 to 192.168.1.1 port 1812 NAS-Identifier = "vpn.domain.com" NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP User-Name = "username" MS-CHAP-Challenge = 0xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx MS-CHAP2-Response = yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy NAS-IP-Address = 192.168.1.10 Proxy-State = 0x3339 Waking up in 3 seconds... rad_recv: Access-Reject packet from host 192.168.1.1:1812, id=1, length=46 Proxy-State = 0x3339 MS-CHAP-Error = "\000E=691 R=0 V=3" Is this possible ? Should it work ? Is it possible to proxy ms-chap-v2 ?

2 3

Proxy accounting and Preproxy_useres
by Assa Tal 06 Mar '06

06 Mar '06

Hello guys/girls I'm a new in this forum And any help will be appriciate Freeradius Version 1.1.0 I'm trying to use proxy accounting to a radius backend server The proxy.conf file look like this and it works fine realm DEFAULT { type = radius authhost=LOCAL accthost=x.x.x.x.:1813 secret=blabla The problem arise when I get a raidus header witout username and without REALM The freeradius server does not proxy this request I was looking at the document and was trying to use the prepproxy_user file to Insert a user name and a realm but I failed the prepproxy_user DEFAULT User-Name =~ "HELP", Auth-Type := Accept, Realm == "HELP", Auth-Type := Accept, Called-Station-Id == 99999, 10x in adv Tal assa

1 0

special characters in passwords + FR + ldap
by Natalia Escalera 06 Mar '06

06 Mar '06

Hello all, Do somebody know how to handle passwords having special characters in between (e.g. $ ) when doing freeradius-ldap authentication? Thank you, Natalia.

2 3

Accounting-Request with invalid signature!
by 艳华杨 05 Mar '06

05 Mar '06

Hi, everyone I use Hostap(0.2.0, the hostapd is 0.4.7)+Freeradius(1.0.2)+Xsupplicant(1.0.1_, and both of the hostap and freeradius are located in the same machine. So I set 127.0.0.1 in clients.conf as freeradius server's client and set 127.0.0.1 as the radius server in hostapd.conf, and the secret of them is the same. But When I setup the authentication, I got the following informantion on radius server: rad_recv: Accounting-Request packet from host 127.0.0.1:32773, id=0, length=70 Received Accounting-Request packet from 127.0.0.1 with invalid signature! (Shared secret is incorrect.) Server rejecting request 1. Finished request 1 Then I checked the "Shared secret" set in both configure file, they are the same. Why did the error appear? On the other hand, everytime I run the xsupplicant, the destination MAC address will change for a while. And this is what I got: [INT] Called event_core_setup()! [INT] Called cardif_linux_rtnetlink_init()! [INT] ADDING INTERFACE : eth1 [INT] Flags are : 06 [INT] Initializing socket for interface eth1.. [INT] Index : 4 Interface initalized! [INT] Interface eth1 is wireless! [INT] The card reported that the destination MAC address is now 00 40 05 AE B7 7C [INT] Userdata is NULL! [INT] Working with ESSID : hostap [CONFIG] Working from config file /etc/xsupplicant.conf. [CONFIG] Opened socket descriptor #7 [ALL] Processing command : /usr/local/etc/1x/startup.sh [ALL] Returning command : /usr/local/etc/1x/startup.sh [ALL] Actual command being called is /usr/local/etc/1x/startup.sh [INT] Got an RTM_NEWLINK! [INT] Working with an interface with index of 4. [INT] -- Got a new interface request. [INT] Found interface eth1, with index of 4! (Ignored) [ALL] Processing interface eth1... (Flags : 05) [INT] The card reported that the destination MAC address is now 44 44 44 44 44 44 [INT] Successfully set WEP key [1] [INT] Successfully set the WEP transmit key [1] [INT] Successfully set WEP key [2] [INT] Successfully set WEP key [3] [INT] Successfully set WEP key [4] [INT] All 4s for dest mac! [INT] Successfully set WEP key [1] [INT] Successfully set the WEP transmit key [1] [INT] Successfully set WEP key [2] [INT] Successfully set WEP key [3] [INT] Successfully set WEP key [4] [CONFIG] MAC address changed! Updating config! [CONFIG] Working from config file /etc/xsupplicant.conf. [ALL] Unknown error (-1) [ALL] Clock tick! authWhile=29 heldWhile=59 startWhen=0 curState=LOGOFF [STATE] (global) -> DISCONNECTED [INT] Successfully set WEP key [1] [INT] Successfully set the WEP transmit key [1] [INT] Successfully set WEP key [2] [INT] Successfully set WEP key [3] [INT] Successfully set WEP key [4] [INT] All 4s for dest mac! [INT] Successfully set WEP key [1] [INT] Successfully set the WEP transmit key [1] [INT] Successfully set WEP key [2] [INT] Successfully set WEP key [3] [INT] Successfully set WEP key [4] [CONFIG] MAC address changed! Updating config! [CONFIG] Working from config file /etc/xsupplicant.conf. [ALL] Unknown error (-1) [ALL] Clock tick! authWhile=29 heldWhile=59 startWhen=0 curState=LOGOFF [STATE] (global) -> DISCONNECTED Why the destination MAC address could change? And I have checked the address "44 44 44 44 44 44" which means no network is detected. So what's wrong? Anyone can help me? Thanks a lot! Helen --------------------------------- 雅虎1G免费邮箱百分百防垃圾信

1 0

ZyAir B-3000 and freeradius
by Luciano PELLE 05 Mar '06

05 Mar '06

Hi all! I'm new to this list and probably this is not the place where to post this kind of questions. I've searched all over the net and read a lot about various configurations for freeradius, but nothing so simple to solve my problem. Hence here is the problem: I'm using Debian Sarge (kernel 2.6.8-2-686) and I'm trying to use freeradius 1.0.2 with quite all extensions available for my distro (dialupadmin, ldap, mysql, perl etc ...). Freeradius is installed correctly (no error messages, during the setup process) and when I launch it with #freeradius -X I get this output: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Addre ss, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-% Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. ... I suppose that this means that the server works fine. Now I'd like (and this is the real question) to use the server with a Zyxel ZyAir B-3000 that has a built in RADIUS function to authenticate users and authorize to access my LAN (mostly for using an Internet connection). What is the simplest way to configure the server and the client (ZyAir) to make them works together? How can I test the settings, before to make them operative? If I can't get help here is there anybody that knows a step-by-step tutorial I can download on the Internet (in italian?)? Thanks in advance for your help and support Luciano PELLE

2 1

no username attribute
by Norbert Grochal 05 Mar '06

05 Mar '06

Hi! My users don't use windows xp "zero configuration" service for wifi. They use Ralink Configurator with profiles. Auth EAP/PEAP. Sometimes after reboot AP or 'unhibernate' Windows XP freeradius logs packets with no User-Name attribute: rad_recv: Access-Request packet from host 10.10.10.9:2048, id=115, length=155 NAS-IP-Address = 10.10.10.9 NAS-Port = 0 Called-Station-Id = "00304f41e217" Calling-Station-Id = "000e2e74b798" NAS-Identifier = "Realtek Access Point. 8181" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000501 Message-Authenticator = 0xebaa8690af8e44f2aa18020db98b43a2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 340 modcall[authorize]: module "preprocess" returns ok for request 340 radius_xlat: '/usr/local/var/log/radius/radacct/10.10.10.9/auth-detail-20060304' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.10.10.9/auth-detail-20060304 modcall[authorize]: module "auth_log" returns ok for request 340 modcall[authorize]: module "chap" returns noop for request 340 modcall[authorize]: module "mschap" returns noop for request 340 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[authorize]: module "suffix" returns noop for request 340 rlm_eap: EAP packet type response id 0 length 5 !!!!!! rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 340 modcall[authorize]: module "files" returns notfound for request 340 !!!!!! rlm_sql (sql): zero length username not permitted modcall[authorize]: module "sql" returns invalid for request 340 modcall: leaving group authorize (returns invalid) for request 340 !!!!!! Invalid user: [<no User-Name attribute>] (from client AP9 port 0 cli 000e2e74b798) Delaying request 340 for 1 seconds And user must restart computer to connect to AP... It is possible to set freeradius not to check User-Name? I use User-Name for logging purposes only. freeradius gets login and password from PEAP and authorize even if User-Name is anything. What should I do? Norbert

2 3

oracle question
by Victor Polukcht 05 Mar '06

05 Mar '06

Can i configure FR to use oracle stored procedures for authentication & accounting? -- Victor Polukcht

2 2

Wrapping @2GB why?
by Jonathan De Graeve 04 Mar '06

04 Mar '06

I am programming my own nas and I keep having the problem that my input-octets and output-octets wrap @2GB instead of 4GB I use rad_put_int(struct rad_handle *h, int type, u_int32_t value) so that's unsigned and in fact should work. I keep getting this in the detail file and in my database: Fri Mar 3 17:26:39 2006 NAS-IP-Address = x.x.x.x NAS-Identifier = "hotspot-2.wlan.imz.be" User-Name = "jonathan" Acct-Status-Type = Stop Acct-Session-Time = 1599 Acct-Authentic = RADIUS Service-Type = Outbound-User NAS-Port-Type = Ethernet NAS-Port = 6 Acct-Session-Id = "c8a1d1e3b8cd5dce" Framed-IP-Address = 192.168.2.255 Called-Station-Id = "00:13:21:cf:fe:02" Calling-Station-Id = "00:c0:9f:84:9e:c8" Acct-Input-Packets = 1345474 Acct-Input-Octets = 53843836 Acct-Input-Gigawords = 0 Acct-Output-Packets = 2041756 Acct-Output-Octets = 2147483648 Acct-Output-Gigawords = 0 Acct-Terminate-Cause = Admin-Reboot Client-IP-Address = x.x.x.x Acct-Unique-Session-Id = "3165ff1f761edd81" Stripped-User-Name = "jonathan" Realm = "NULL" Timestamp = 1141403199 It stops at 2147483648, even if my own NAS internal data is bigger then that. My database has the same problem: +-----------------+------------------+ | AcctInputOctets | AcctOutputOctets | +-----------------+------------------+ | 53843836 | 2147483648 | +-----------------+------------------+ The Mysql AcctInputOctets and AcctOutputOctets are bigint(12) Anyone knows why this happens? J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be

2 1

Proxy or not based on Client-IP-Address
by Dennis Skinner 03 Mar '06

03 Mar '06

Hello all, Looking for a pointer in the right direction. I want to reject requests from a particular realm that are not coming from a particular set of Client-IP-Addresses. This realm is normally proxied through my servers, so I don't authorize/authenticate them at the moment, they are simply passed to the next RADIUS server. However, some of those users are not using the proper upstream modem provider that they should be and I want to stop that. Other realms coming through that modem provider should be handled like normal. I have looked at the rlm_passwd module, but I'm not sure that is the way to go. I'm thinking that whatever I do should be in the pre_proxy section rather than the post_proxy so the downstream RADIUS server isn't sending back ACCEPT and the user getting REJECT. Thanks! -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

1 0