April 2006 - Freeradius-Users - lists.freeradius.org

Can you use TLS and Request users authentication as well
by Walter Reynolds 22 Jun '06

22 Jun '06

Hi, What I am trying to figure out is a way to not only have a certificate, but a secondary way to verify that that certificate is being used by a person we allow. If we put cert onto a machine, we have authenticated that the cert was trusted. The problem is coming from a university, we do not have a way to control a users machine. So a user could take that certificate and put it onto a friends machine. This friend may not be affiliated and should not have access. So I would like to use the cert as machine authentication and then follow up with another (username/pass) using the KRB module. Is this something that can be done? Has anyone run into a similar problem and what did they do? I know we could go TTLS and not have a machine cert, but then we get fears of man-in-the-middle. Thanks. -- Walter Reynolds University of Michigan

5 9

Regarding VLAN attributes
by radhika putty 10 Jun '06

10 Jun '06

Hi.. When we use VLAN tunneled attributes how do we send the VLAN id value. For ex if i give a vlan group 10 when configuring the switch how do i pass that attribute in my program.In the value field I need to set it as 10 or VLAN10 --------------------------------- Yahoo! Messenger with Voice. Make PC-to-Phone Calls to the US (and 30+ countries) for 2¢/min or less.

2 1

Another RPM build issue with version 1.1.1
by Sandworm 08 Jun '06

08 Jun '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello There appears to be a conflict with the Makefiles in the doc directories and the behaviour of RPM. With version 1.1.0, this was OK as they were both consistent, but are not with version 1.1.1. Now when the RPMs are built (on RHEL3 U6), the build bombs out with: RPM build errors: Installed (but unpackaged) file(s) found: /usr/share/doc/freeradius/Acct-Type /usr/share/doc/freeradius/Autz-Type /usr/share/doc/freeradius/CYGWIN /usr/share/doc/freeradius/ChangeLog /usr/share/doc/freeradius/DIFFS /usr/share/doc/freeradius/MACOSX etc... This is because the Makefiles in the doc directories have lines like this: $(INSTALL) -d -m 755 $(R)$(datadir)/doc/freeradius whereas version 1.1.0 had lines like: $(INSTALL) -d -m 755 $(R)$(datadir)/doc/freeradius- $(RADIUSD_VERSION) RPMs %doc macro, however (AFAIK), uses the version in the path, and the documentation seems to say this too (from http://www.rpm.org/max-rpm-snapshot/s1-rpm-inside-files-list- directives.html, "When the package is installed, RPM creates a directory in the documentation directory named the same as the package (ie, <software>-<version>-<release>)"). This is what I am seeing during the RPM build - a relevant extract: Processing files: freeradius-1.1.1-0 Executing(%doc): /bin/sh -e /var/tmp/rpm-tmp.18818 + umask 022 + cd /usr/src/redhat/BUILD + cd freeradius-1.1.1 + DOCDIR=/var/tmp/freeradius-root/usr/share/doc/freeradius-1.1.1 + export DOCDIR Incidentally, apart from this, even if the Makefile/RPM conflict were resolved, not all files get copied into the doc directory, I think, and this was true with version 1.1.0 as well. The only files seen there are: ls /usr/share/doc/freeradius-1.1.0 ChangeLog COPYRIGHT INSTALL README todo To get the other files there, it would unfortunately need a more detailed list in the %files section of the SPEC file as shown below: %files %defattr(-,root,root) %doc doc/Acct-Type doc/Autz-Type doc/CYGWIN doc/ChangeLog doc/DIFFS doc/MACOSX %doc doc/OS2 doc/Post-Auth-Type doc/RADIUS-LDAP-eDirectory doc/RADIUS-SQL.schema %doc doc/README doc/Session-Type doc/Simultaneous-Use doc/aaa.txt doc/ascend %doc doc/bay doc/bugs doc/cisco doc/coding-methods.txt doc/configurable_failover %doc doc/duplicate-users doc/ldap_howto.txt doc/load-balance.txt doc/misc-nas %doc doc/module_interface doc/mssql doc/performance-testing doc/processing_users_file %doc doc/proxy doc/radrelay doc/release-method.txt doc/rfc/ doc/rlm* doc/supervise-radiusd.txt %doc doc/tuning_guide doc/variables.txt todo/ COPYRIGHT INSTALL Regards SW -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkQp19gACgkQmw4BJyaatJ3xhgCgsjwbq8mP6XhQpsqSTLCBFena9fUA nAvGkYPRHnlRzCnV+FMt5R6F5lOm =jS3p -----END PGP SIGNATURE-----

4 3

PB with Accent in nspmPassword in request LDAP between FREE-RADIUS 1.0.5 (suse) and edirectory novell 6.5
by freeradius＠rockwellcollins.com 18 May '06

18 May '06

Hello, I set up a solution implementing eap-PEAP user authentication and VLAN assignment with · : - FREE-RADIUS 1.0.5 on suse - ENTERASYS Switch - Edirectory Novell 6.5 This solution is operational. On the other hand, if the user uses a password using characters with accents, this solution does not work. I identified the problem in the LDAP request (ask nspmPassword) between FREE-RADIUS 1.0.5 and the edirectory of novell 6.5. The problem seems to come from FreeRadius server because edirectory answers correctly with my test tool " LDAPBrowser ". Do you have met this problem? Have you a solution to propose to me? thank you in advance. Best regards Stephan

2 6

v1.1.1 rlm_eap compile problem (no prob in v1.1.0)
by Aaron Paetznick 15 May '06

15 May '06

I'll save people a lot of time and just paste the bomb out below. Help??? Otherwise, can I simple choose to not compile rlm_eap (I don't use it). I've tried --disable-eap and similar arguements. Thanks. --Aaron /usr/local/src/freeradius-1.1.1/libtool --mode=compile gcc -O2 -march=pentium4 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/usr/local/src/freeradius-1.1.1/src/include -I../.. -I../../libeap -DNO_OPENSSL -c rlm_eap_peap.c mkdir .libs gcc -O2 -march=pentium4 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/usr/local/src/freeradius-1.1.1/src/include -I../.. -I../../libeap -DNO_OPENSSL -c rlm_eap_peap.c -fPIC -DPIC -o .libs/rlm_eap_peap.lo In file included from eap_peap.h:25, from rlm_eap_peap.c:24: ../../libeap/eap_tls.h:138: error: parse error before "SSL" ../../libeap/eap_tls.h:138: warning: no semicolon at end of struct or union ../../libeap/eap_tls.h:141: error: parse error before '*' token ../../libeap/eap_tls.h:141: warning: type defaults to `int' in declaration of `into_ssl' ../../libeap/eap_tls.h:141: warning: data definition has no type or storage class ../../libeap/eap_tls.h:142: error: parse error before '*' token ../../libeap/eap_tls.h:142: warning: type defaults to `int' in declaration of `from_ssl' ../../libeap/eap_tls.h:142: warning: data definition has no type or storage class ../../libeap/eap_tls.h:172: error: parse error before '}' token ../../libeap/eap_tls.h:172: warning: type defaults to `int' in declaration of `tls_session_t' ../../libeap/eap_tls.h:172: warning: data definition has no type or storage class ../../libeap/eap_tls.h:182: error: parse error before "tls_session_t" ../../libeap/eap_tls.h:186: error: parse error before "SSL" ../../libeap/eap_tls.h:188: error: parse error before '*' token ../../libeap/eap_tls.h:371: error: parse error before "SSL_CTX" ../../libeap/eap_tls.h:371: warning: no semicolon at end of struct or union ../../libeap/eap_tls.h:372: warning: type defaults to `int' in declaration of `eap_tls_t' ../../libeap/eap_tls.h:372: warning: data definition has no type or storage class ../../libeap/eap_tls.h:383: warning: type defaults to `int' in declaration of `SSL' ../../libeap/eap_tls.h:383: error: parse error before '*' token ../../libeap/eap_tls.h:384: error: parse error before "X509_STORE_CTX" ../../libeap/eap_tls.h:386: error: parse error before "SSL" ../../libeap/eap_tls.h:387: error: parse error before '*' token ../../libeap/eap_tls.h:387: error: parse error before '*' token ../../libeap/eap_tls.h:387: warning: type defaults to `int' in declaration of `cbtls_rsa' ../../libeap/eap_tls.h:387: warning: data definition has no type or storage class ../../libeap/eap_tls.h:390: error: parse error before '*' token ../../libeap/eap_tls.h:390: error: parse error before '*' token ../../libeap/eap_tls.h:390: warning: type defaults to `int' in declaration of `eaptls_new_session' ../../libeap/eap_tls.h:390: warning: data definition has no type or storage class ../../libeap/eap_tls.h:391: error: parse error before '*' token ../../libeap/eap_tls.h:392: error: parse error before '*' token ../../libeap/eap_tls.h:393: error: parse error before '*' token ../../libeap/eap_tls.h:397: error: parse error before '*' token ../../libeap/eap_tls.h:398: error: parse error before '*' token In file included from rlm_eap_peap.c:24: eap_peap.h:52: error: parse error before "tls_session_t" rlm_eap_peap.c: In function `eappeap_authenticate': rlm_eap_peap.c:165: error: `tls_session' undeclared (first use in this function) rlm_eap_peap.c:165: error: (Each undeclared identifier is reported only once rlm_eap_peap.c:165: error: for each function it appears in.) rlm_eap_peap.c:165: error: parse error before ')' token gmake[9]: *** [rlm_eap_peap.lo] Error 1 gmake[9]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules/rlm_eap/types/rlm_eap_peap' gmake[8]: *** [common] Error 2 gmake[8]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules/rlm_eap/types' gmake[7]: *** [all] Error 2 gmake[7]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules/rlm_eap/types' gmake[6]: *** [common] Error 2 gmake[6]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules/rlm_eap' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/usr/local/src/freeradius-1.1.1/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/usr/local/src/freeradius-1.1.1/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/local/src/freeradius-1.1.1/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/local/src/freeradius-1.1.1' make: *** [all] Error 2

4 3

FreeRADIUS 1.1.1 Segmentation fault on Fedora 4
by Nikolas Thoman 09 May '06

09 May '06

I am running FreeRADIUS 1.1.1 on a Fedora Core 4 server (kernel 2.6.11-1.1369_FC4smp) to authenticate using EAP-SIM. After ~400 successful auths at 20 requests/second the radiusd service encounters a segmentation fault. The output of the gdb dump is as follows: Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1208572224 (LWP 9805)] 0x0072ec33 in _int_malloc () from /lib/libc.so.6 (gdb) bt #0 0x0072ec33 in _int_malloc () from /lib/libc.so.6 #1 0x00730792 in malloc () from /lib/libc.so.6 #2 0x005007e4 in eap_compose (handler=0x8fb8220) at eap.c:395 #3 0x004ffa94 in eap_authenticate (instance=0x8f8e4b8, request=0x8fbe648) at rlm_eap.c:341 #4 0x08053009 in modcall () #5 0x0805351d in modcall () #6 0x0805312d in modcall () #7 0x080525ba in find_module_instance () #8 0x0804c532 in rad_check_password () #9 0x0804cb03 in rad_authenticate () #10 0x08054c0a in rad_respond () #11 0x08056287 in main () (gdb) I have another FreeRADIUS 1.0.3 server running on a Red Hat 9 server (kernel 2.4.20-8) that has had no problems running this kind of traffic. Any help in diagnosing the reason why I'm encountering a fault in malloc would be much appreciated. Thanks, Nik

4 17

Special characters in users file
by sumi thra 09 May '06

09 May '06

Hi All, Can we use special characters like $, {, [, ( in the users file?? I have defined some vendor specific attribute in users file. When i escape with \ still im not able to start the server. Whether the freeradius does not allow these characters ?? or we can accept those characters by specifying in different way?? Any help in the earliest will be of great help. Awaiting for your reply. :-) Thanks Sumi

2 11

Missing User-Name attribute causing a segfault in attr_rewrite
by Dennis Skinner 05 May '06

05 May '06

Hello, I finally got around to upgrading our RADIUS servers to FR 1.1.1. Everything is working well except we seem to have a customer somewhere who is able to attempt to auth without sending a User-Name attribute and a blank User-Password. I'm not sure at this point if it is an attempted exploit or just a badly coded client. Here is an attempt: --- Walking the entire request list --- Cleaning up request 1 ID 88 with timestamp 44512aa3 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx:21674, id=218, length=203 Framed-Protocol = PPP User-Password = "" Calling-Station-Id = "##########" Called-Station-Id = "##########" NAS-Port-Type = Async Cisco-NAS-Port = "Async172" NAS-Port = 172 Connect-Info = "28800/26400 V34+/V44/LAPM (53333/26400)" Cisco-AVPair = "v92-info=V.92 QC MOH/QC Full Train Success/0/0" Service-Type = Framed-User NAS-IP-Address = xxx.xxx.xxx.xxx Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[authorize]: module "suffix" returns noop for request 2 rlm_attr_rewrite: Could not find value pair for attribute Realm modcall[authorize]: module "fix_realm" returns noop for request 2 The very next line is the segfault. Here is my "fix_realm" module: attr_rewrite fix_realm { attribute = Realm searchin = packet searchfor = "blue.*$$" replacewith = "bluefrog.com" ignore_case = yes new_attribute = no max_matches = 1 append = no } (we used to use both bluefrognet.net and bluefrog.biz, so this attempts to normalize everyone since the username in the db is always user(a)bluefrog.com) I think the fact that there is no realm may be causing the segfault. Unfortunately, I have no idea how to recreate the situation myself and I have yet to try to track down the customer. I didn't see this problem listed on bugs.freeradius.org and don't recall seeing mention of it on the list. The other thing I changed in the authorize section of the config file is that I moved the suffix (and fix_realm) higher in the list (as you can probably tell from the debug output). Here is my authorize section: authorize { suffix fix_realm preprocess chap mschap eap files redundant { # slave first sql2 sql1 handled } } My old config wasn't using huntgroups, so I didn't need to fix_realm before preprocessing. I need to do that now, hence suffix and fix_realm are at the top. I will continue to dig at this problem from my end, but I thought maybe Alan or someone could modify radclient to send a packet like above and see if they can recreate the bug (or better yet, have a look at the code and go, "oh yeah, that is why that happened"). My C coding skills have all but rusted solid at this point. Let me know if you need any more information. Thanks! -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

3 6

rlm_attr_rewrite doesn't read the regexp in searchfor
by Mark Supersonik 03 May '06

03 May '06

Hi Freeradius friends! I am programming a proxyRadius (FreeRadius v1.88.2.3 in Debian) in order to write a Session-Tiemout attribute with a value =3600 if the attribute doesn't exist yet. I have defined an instance of attr_rewirte called setSessionTimeout3600 with append=no, new_attribute=no, searchfor= NULL, searchin =reply and replacewith = "3600" I call then it in post-proxy stage, but i found that it doesn't do nothing. The only thing it works is to set new_attribute to yes, but then i have 2 attributes Session-Tiemout, there is no rewriting and no parsing of regexp. Help please, thank you all, Marc _________________________________________________________________ Horóscopo, tarot, numerología... Escucha lo que te dicen los astros. http://astrocentro.msn.es/

1 1

RE: on the right track?
by Galloway, David Mr KRS 02 May '06

02 May '06

I just worked this out yesterday. Best way for me (I found) was to create two groups (one is pubnet-dialup the other is pubnet-extend) I set this in the /etc/raddb/users file # Authentication for pubnet-dialup group DEFAULT Auth-Type = System, Group == "pubnet-dialup" Fall-Through = 1 # authentication for pubnet-extend group DEFAULT Auth-Type = System, Group == "pubnet-extend" Fall-Through = 1 # Defaults for all framed connections. # # sets timeout for group "pubnet-dialup" DEFAULT Service-Type == Framed-User, Group == "pubnet-dialup" Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Session-Timeout = 14400, Idle-Timeout = 1800, Fall-Through = Yes # Sets timeout for group "pubnet-extend" DEFAULT Service-Type == Framed-User, Group == "pubnet-extend" Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Session-Timeout = 28800, Idle-Timeout = 1800, Fall-Through = Yes I authenticate against two groups. Then set the timeouts per each group (first is for 4 hours, second 8). Hope that helps. Regards, David Galloway Public Networks Administration KRS IT Network Operations Help Desk (805) 355-2444 Direct (805) 355-4512 -----Original Message----- From: freeradius-users-bounces+david.l.galloway=us.army.mil(a)lists.freeradius.org [mailto:freeradius-users-bounces+david.l.galloway=us.army.mil@lists.freeradi us.org] On Behalf Of mbjohn(a)duke.edu Sent: Thursday, February 23, 2006 3:43 AM To: freeradius-users(a)lists.freeradius.org Subject: on the right track? Hello all! I've tried to search the web and the archives for an answer to this question and didn't come up with anything, so I hope I'm not duplicating a question that's already been answered. Currently, where I work, we run two modem pools. One pool is limited to certain users who are allowed to connect up to 8 hrs at a time. The other pool is for general users who are given 15 min to quickly check email or search for something on the web (fwiw, they're allowed to reconnect after their time is up....). As broadband has become more available, less and less users are using the modem pool. We still have a handful of people from both groups who are still using it. So, in the interest to provide the service for the people still using it while not paying for unused lines, we're trying to consolidate things. We have a Cisco AS5300 terminal server that already uses freeradius w/ kerberos to authenticate users. We would like to take that a step further and use freeradius to limit usage time based on the user name (certain users are allowed 8hrs while all others are given 15min). Looking over the config files in /etc/raddb, it appears the attrs file is just what I need to use. Would I be able to use a combination of huntgroups and the attrs file to accomplish what I need? I know in the documentation for the "fisp" entry, it talks about not having a Fall-Through entry. Does that mean it CANNOT have a Fall-Through entry, or that the given example does not? Am I on the right track with this, or should I look elsewhere? Thanks for your help! Brian - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 2