September 2006 - Freeradius-Users - lists.freeradius.org

rlm_ldap and 'unencrypted' connections
by Thibault Le Meur 21 Sep '06

21 Sep '06

ine doc/rlm_ldap I've read: <quote> # identity: DN under which LDAP searches are done password: pasword # which authenticate this DN default: anonymous bind, no password # required NOTE: searches are done now over unencrypted connection! </quote> I'm especially concerned about the 'searches are done now over unencrypted connection!' sentence. Does this mean that even if I use "start_tls = yes", searches will be performed unencrypted ? If yes, isn't the following procedure a way to enforce encryption on searches ? * do not use "start_tls = yes" * use "port = 636" and/or "tls_mode = yes" * have your ldap server reply only to port 636 in ldaps. Thanks in advance, Thibault

1 0

Freeradius Suse distro
by LeRoy DeVries 21 Sep '06

21 Sep '06

Does the latest version (1.1.3) have the experimental modules that you had to compile with in the old version 1.03

3 5

RE: MS Vista RC1 and Freeradius 802.1x
by David Mitton 21 Sep '06

21 Sep '06

Be aware that the EAP subsystem in Vista has been totally re-architected. There are new APIs and legacy module support. Anything could go wrong. Dave. > ----- Original Message ----- > From: "Dourty, Brian R. (IATS)" <DourtyB(a)missouri.edu> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: RE: MS Vista RC1 and Freeradius 802.1x > Date: Thu, 21 Sep 2006 10:59:48 -0500 > > > I haven't spent a lot of time debugging the problem yet, but out of the > box Vista doesn't work with our 802.1x/PEAP/MSChapV2 config we have been > using successfully on WinXP. > > Brian Dourty > >

1 0

What kind of error in client-cert using EAP?
by Alexandros Gougousoudis 21 Sep '06

21 Sep '06

Hi, I have trouble with one XP-SP2 client, using a certificate to make 802.1x Auth over EAP-TLS. The cert is a machine cert. On the serverside I get this (using -X -A) in authenticate: modcall: entering group authenticate for request 33 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0ef8], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00bd], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 33 modcall: leaving group authenticate (returns handled) for request 33 Sending Access-Challenge of id 0 to 10.48.244.21 port 49154 EAP-Message = 0x0125040a0dc00000100e1[...] Which indicates that there is a problem in the client-cert. Can it be more detailed? I exported the cert and the key now 4 times in different manners (as p12, as der) and the errors is still there. Extended attribute is also included. The funny thing is, that I already have 5 XP machines running in my network, doing an EAP-TLS auth over the switch. It means also that in my authorize section (Auth-Type := EAP) I can get a Access-Accept Message. On the server I get the Access-Requests, create a Access-Challenge and thats all. Theres nothing coming back from the client. Please help Alex -- ServiceCenter IT - Alexandros Gougousoudis (Leiter) Gemeinsame Einrichtung der Kunsthochschule Berlin-Weissensee, Hochschule für Musik "Hanns Eisler" und der Hochschule für Schauspielkunst "Ernst Busch". Tel.: 030 / 477 05 - 444 * Fax.: 030 / 477 05 - 445

5 11

PEAP and domain logon
by Christoffer Dahl Petersen 21 Sep '06

21 Sep '06

Hi! I have followed this excellent tutorial: http://homepages.lu/charlesschwartz/radius/freeRadius_AD_tutorial.pdf and it works perfect!! I have checked the option "automatically use my windows logon name and password..." on my XP Clients, but only users who has been logged in before can log in again, because of their cached credentials. To me is the "chicken or the egg" dilemma, does anyone have a solution for this issue? Thanks, Christoffer

2 1

Freeradius + Cisco VoIP
by Geoffrey Cauchi 21 Sep '06

21 Sep '06

Hi I'm using free radius 1.1.3, with postgres on fedora core 5. I am trying to authenticate a user's request coming in from a Cisco VoIP gateway. The radius server accepts the request, and sends an accept to the gateway, but since it is VoIP, it is expecting h323 AV Pairs. Can anyone provide a sample config of the AV Pairs required by a cisco VoIP gateway to accept a user? Thanks Gef

3 6

freeradius stops with hostapd
by Michał Prochaczek 21 Sep '06

21 Sep '06

Hi I am trying to set freeradius +hostapd on Debian I have installed freeradius from .deb testing package and than from .tar (1.1.3) In init.d freeradius starts first and than hostapd is started. Immediately after hostapd is started freeradius disappears from process list. I have tested running freeradius manually and than starting hostapd. Result is the same. Changing starting order makes survive freeradius few minutes probably until first request is send from hostapd. The only message I got in log file is: Tue Sep 19 21:53:26 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Tue Sep 19 21:53:26 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Tue Sep 19 21:53:26 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Tue Sep 19 21:53:26 2006 : Info: Ready to process requests. Tue Sep 19 21:55:30 2006 : Error: WARNING: Unresponsive child (id 3073981360) for request 0 Or another version: Tue Sep 19 21:58:59 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Tue Sep 19 21:58:59 2006 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Tue Sep 19 21:58:59 2006 : Info: rlm_eap_tls: Loading the certificate file as a chain Tue Sep 19 21:58:59 2006 : Info: Ready to process requests. Tue Sep 19 21:59:58 2006 : Error: Discarding duplicate request from client localhost:1029 - ID: 0 due to unfinished request 0 in freeradius -X I get this output: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: bind_address = 127.0.0.1 IP address [127.0.0.1] main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/freeradius/certs/cert-srv.pem" tls: certificate_file = "/etc/freeradius/certs/cert-srv.pem" tls: CA_file = "/etc/freeradius/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/freeradius/certs/dh" tls: random_file = "/etc/freeradius/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication 127.0.0.1:1812 Listening on accounting 127.0.0.1:1813 Ready to process requests. rad_recv: Accounting-Request packet from host 127.0.0.1:1036, id=1, length=79 Acct-Status-Type = Accounting-Off Acct-Authentic = RADIUS NAS-IP-Address = 127.0.0.1 NAS-Identifier = "localhost" Called-Station-Id = "00-04-47-50-1A-1F:test" Acct-Terminate-Cause = NAS-Reboot Processing the preacct section of radiusd.conf modcall: entering group preacct for request 0 I would be greateful for any help. Michal

2 1

How to get FreeRadius 2.0.0 pre version???
by 나종현 21 Sep '06

21 Sep '06

2 1

Radius dies, on certificate verification
by Robert Myers 21 Sep '06

21 Sep '06

I'm wondering if anyone else has seen this. My setup is as follows, Seimens controller doing .1x auth, EAP-TLS Both requests are from different users, and what I have now, is set max_requests_per_server to 300 Doesn't seem to have helped, as radwatch is reporting that another radiusd died.... Could this simply be an error with the specific certificates? I haven't looked at it long enough to determine if the same two or three requests are killing radiusd... I got the following when running radiusd -X with openssl .0.9.7c on gentoo, radius 1.1.1-r1 modcall[authorize]: module "sql" returns notfound for request 14091 modcall: leaving group authorize (returns updated) for request 14091 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 14091 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler *** glibc detected *** free(): invalid pointer: 0x0b415350 *** Aborted I had thought that perhaps this was an error with openssl , so I recompiled, with 0.9.8 openssl on gentoo, radiusd 1.1.1-r1 and now I get this. modcall[authorize]: module "sql" returns notfound for request 13856 modcall: leaving group authorize (returns updated) for request 13856 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 13856 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0297], Certificate Segmentation fault

3 5

DOCUMENTATION
by Abel Monzon 21 Sep '06

21 Sep '06

Hello, some time is so hard to understand the mean of everything, but I can't find the mean and why is so important, example: The doc toll about how config NAS, Proxy, etc, but I can't understand what is that and why I must config that...Please... exist any reference? Thanks any way...

2 1