October 2007 - Freeradius-Users - lists.freeradius.org

Accounting with Oracle and stored procedures
by Tore Anderson 10 Oct '07

10 Oct '07

Hi. I'm having problems integrating FreeRADIUS with Oracle (Instantclient 10.2.0.3 library). My client makes two stored procedures available to me: FUNCTION session_start(id_in IN VARCHAR2, terminal_address_in IN VARCHAR2, nas_address_in IN VARCHAR2, msisdn_in IN VARCHAR2, apn_in IN VARCHAR2, rat_in NUMBER, start_date_in IN DATE) RETURN INTEGER; and FUNCTION session_stop(id_in IN VARCHAR2, bytes_transmitted_in IN NUMBER, bytes_received_in IN NUMBER, stop_date_in IN DATE) RETURN INTEGER; The juicy bits from my sql{} statement: driver = "rlm_sql_oracle" server = "foobar" login = "foobar" password = "foobar" radius_db = "(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=foobar)(PORT=1521)))(CONNECT_DATA=(SERVICE_NAME=foobar)))" accounting_start_query = "SELECT session_start('%{Acct-Session-Id}', '%{Framed-IP-Address}', '%{NAS-IP-Address}', '%{Calling-Station-Id}', '%{Called-Station-Id}', '0', TO_DATE('%S','yyyy-mm-dd hh24:mi:ss')) FROM dual" accounting_stop_query = "SELECT session_stop('%{Acct-Session-Id}', '0', '0', TO_DATE('%S','yyyy-mm-dd hh24:mi:ss')) FROM dual" This is parsed correctly and FreeRADIUS (v1.1.0) starts up nicely enough. But when an accounting query comes in, I get the following error: rlm_sql (sql): Reserving sql socket id: 4 SELECT session_start('c16dd2c12dc4536a', '10.16.12.253', '10.0.0.1', '12341324', 'foobar', '0', TO_DATE('2007-10-10 16:16:19','yyyy-mm-dd hh24:mi:ss')) FROM dual rlm_sql_oracle: execute query failed in sql_query: ORA-24374: define not done before fetch or execute and fetch rlm_sql (sql): Attempting to connect rlm_sql_oracle #4 rlm_sql (sql): Connected new DB handle, #4 SELECT session_start('c16dd2c12dc4536a', '10.16.12.253', '10.0.0.1', '12341324', 'foobar', '0', TO_DATE('2007-10-10 16:16:19','yyyy-mm-dd hh24:mi:ss')) FROM dual rlm_sql_oracle: execute query failed in sql_query: ORA-24374: define not done before fetch or execute and fetch rlm_sql (sql): failed after re-connect rlm_sql (sql): Couldn't insert SQL accounting START record - ORA-24374: define not done before fetch or execute and fetch We've also tried changing from FUNCTION to PROCEDURE, but no change in behaviour. Anyone here had similar problems? I'm thankful for any suggestions! Regards -- Tore Anderson

1 0

Re: IPv6 deployment "howto"
by Matthias Cramer 10 Oct '07

10 Oct '07

Hi Mark Mark J Elkins wrote: > Matthias Cramer wrote: >>>> What magic lines would I need to add to my Cisco and what magic to add >>>> to FreeRadius? >>>> Anyone have Dialup clients being issued IPv6 addresses yet? >>>> >>>> 1 - I expect to add some sort of IPv6 field to MySQL (ie - for a static >>>> IPv6 address or to signify the NAS to use a Dynamic address) >>>> 2 - I expect the "authorize_check_query" and other SQL queries to change >>>> a bit... ie return IPv6 data - without breaking IPv4 only NAS's >>>> 3 - I expect to add an IPv6 pool and other lines of magic to my Cisco. >>>> >>> There's Framed-IPv6-prefix, where you can assign Ip's to a client. >>> >> I do it with: >> >> cisco-avpair = "ipv6:route#1=2001:dead:beef::/64" >>srclient/faces/jsp/trademark/sr300.jsp?language=de&section=tm&id=510320 >> I do not use dynamic allocation. >> >> Cheers >> >> Matthias >> > Can I ask why? (why no dynamic). I don't even know if there is a way to > do this.... Because all the people i serve IPv6 this way are ADSL Customers, who are allways online anyway, and like to be able to run a webserver or such. > Why a /64 - and not /60 or /56 ?? (not even sure if thats possible) I do /64 and /48, but any sensible subnet is possible in my oppinion. > Sorry about the questions - but very few people seem to be providing any > sort of IPv6 access to dialup clients.... > > Some more.. > Do you use FreeRadius 2.0 or something older. No, i unse 1.1.3 because this is the last version which seams not to have the sighup bug. > In order to support IPv6 - what new fields did you add to your backend > (database). I use a traditional "users" file .... > Did you add any new "cisco-avpair" parts apart from an IPv6 Route ... No > which kind of seems strange to me - should you not have added a Prefix > (ipv6:prefix#1) instead ? .. which adds an entry to the RIB table anyway? > What did you have to add to the Cisco for user access? interface Virtual-Template1 mtu 1492 ip unnumbered Loopback0 no ip redirects no ip proxy-arp ip tcp adjust-mss 1452 ipv6 enable qos pre-classify peer default ip address pool ADSLPool1 ppp mtu adaptive ppp authentication chap pap callin ADSL ppp authorization ADSL > Are many (any?) people using IPv6? Not that many .. we have abut 5-10 Customers using IPv6 > What did they have to do on their end to get an address? Have a IPv6 Capable router... Which is a Cisco, Linux, *BSD Router. Probably it will also work with MacOSX or Vista doing PPP or PPPoE depending on what service you provice. > I promise that I'll one day update the wiki with this sort of info.. That sounds nice. Best regards and greetings to South Africa Matthias -- Matthias Cramer System & Network Manager Interway Communication GmbH Phone +41 43 500 1111 Josefstrasse 225 Fax +41 44 271 3535 CH-8005 Zuerich http://www.interway.ch/

2 1

radius for cisco management
by German Garay 09 Oct '07

09 Oct '07

Hi I want to do per user command authorization in a cisco network to replace a tacacs+ server. But I can´t find a how to in a page, can you send me the link? Thanks Germán

3 3

Simultaneous-Use and PEAP doesn't work correctly.
by Marcotte, Tyler 09 Oct '07

09 Oct '07

Hi, I've configured Simultaneous-Use on my freeradius server and have it configured to use PEAP as an authentication method. Users can authenticate perfectly well, however when the Simultaneous-Use limit is exceeded, it only half works. The user is not allowed on, the PEAP message is set to FAILURE, but no Access-Reject is ever sent. I have also tried with md5 authentication and it works as expected. Unfortunately, md5 authentication is not an option. What I really need is for that Reject to be sent back after the user logs on too many times. I've attached the radiusd -X output (radius.out chopped to the end), radiusd.conf, eap.conf, and users file. Any help would be greatly appreciated as I've been searching the web for two full days now with no luck. Thank you, -Tyler

2 2

eap/ttls with windows XP and Linux
by elhammoud rachida 09 Oct '07

09 Oct '07

i'am trying to implement eap / ttls with Windows xp work well but i haven't put verify server certificate, it's correct? If yes why not put verify server certificate? And with xsupplicant of Linux ( ubuntu ) always in wired I receive this message:No configuration information for network " ( null ) ) " found. using default. then, successfully authenticate eth0. I have make / sbin / ifconfig eth0 up but doesn't work. thanks _________________________________________________________________ Gagnez des écrans plats avec Live.com http://www.image-addict.fr/

1 0

AAA for cisco management
by German Garay 08 Oct '07

08 Oct '07

Hi:

1 0

access rejected
by 翔李 08 Oct '07

08 Oct '07

Hi, I added FreeRADIUS-EAP-TNC-Patch on FreeRADIUS which is developed by TNC@FFH so that eap-tnc can be supported by FreeRADIUS.Then I entered radiusd -X command but some error occured , which indicated that access was rejected and the debug info is "Could not open file tnc_log.properties!" but the file tnc_log.properties had been put under /etc/tnc/ . The debug info is appended with this mail. Could you please tell me why the access was rejected and how to deal with the problem? Thank you very much. --------------------------------- 雅虎邮箱，终生伙伴！ --------------------------------- 雅虎邮箱，终生伙伴！ #radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tnc" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type tnc rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Addre ss, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/de tail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 25.20.227.141:1645, id=39, length=125 NAS-IP-Address = 25.20.227.141 NAS-Port = 50001 NAS-Port-Type = Ethernet User-Name = "Lumpy" Called-Station-Id = "00-15-62-BE-79-03" Calling-Station-Id = "00-15-58-7B-83-9D" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0200000a014c756d7079 Message-Authenticator = 0x114efcb9b595e8e9a67550efd45f3d04 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "Lumpy", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tnc §§§§§§§§§§§§§§§§§§§§§§§§§ tnc_initiate: 1191750591 VLAN_ISOLATE: 97 VLAN_ACCESS: 96 PATH to SO: /usr/local/fhh/NAA-TNCS/build/libNAA-TNCS.so OPENED HANDLE! SO /usr/local/fhh/NAA-TNCS/build/libNAA-TNCS.so found! Searching for function exchangeTNCCSMessages TNCS is connected $$$$$$$$$$$$$$$$Flags: 33 TYPE: EAP-TNC set Malloc 2 bytes for packet Set Flags/Version: 33 No TNCCS-Data presentPacket built modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 39 to 25.20.227.141 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010100062621 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcbdca71f5a85c4d539cc34de801a92f2 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 25.20.227.141:1645, id=40, length=1175 NAS-IP-Address = 25.20.227.141 NAS-Port = 50001 NAS-Port-Type = Ethernet User-Name = "Lumpy" Called-Station-Id = "00-15-62-BE-79-03" Calling-Station-Id = "00-15-58-7B-83-9D" Service-Type = Framed-User Framed-MTU = 1500 State = 0xcbdca71f5a85c4d539cc34de801a92f2 EAP-Message = 0x0201040a26013c3f786d6c2076657273696f6e3d22312e302220656e 636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f22203f3e0a3c544e434353 2d426174636820426174636849643d22302220526563697069656e743d22544e43532220786d6c6e 733d22687474703a2f2f7777772e74727573746564636f6d707574696e6767726f75702e6f72672f 4957472f544e432f315f302f49465f544e434353232220786d6c6e733a7873693d22687474703a2f 2f7777772e74727573746564636f6d707574696e6767726f75702e6f72672f4957472f544e432f31 5f302f49465f544e434353232068747470733a2f2f7777772e EAP-Message = 0x74727573746564636f6d707574696e6767726f75702e6f72672f584d 4c2f534348454d412f544e4343535f312e302e787364223e0a0a20203c494d432d494d562d4d6573 736167653e0a202020203c547970653e46464646303033303c2f547970653e0a202020203c426173 6536343e5044393462577767646d567963326c76626a30694d5334774969426c626d4e765a476c75 5a7a3069565652474c54676949484e305957356b59577876626d5539496d35764969412f50676f38 526b684958306c4e513068766333525459324675626d567949485a6c636e4e7062323439496a4575 4d43492b43676f674944784962334e3055324e68626d356c63 EAP-Message = 0x69426859335270646d5539496e5279645755694c7a344b436a777652 6b684958306c4e513068766333525459324675626d567950676f3d3c2f4261736536343e0a20203c 2f494d432d494d562d4d6573736167653e0a0a20203c494d432d494d562d4d6573736167653e0a20 2020203c547970653e46464646303031303c2f547970653e0a202020203c4261736536343e504439 3462577767646d567963326c76626a30694d5334774969426c626d4e765a476c755a7a3069565652 474c54676949484e305957356b59577876626d5539496d35764969412f50676f38526b684958306c 4e51314a6c5a326c7a64484a3549485a6c636e4e7062323439 EAP-Message = 0x496a45754d43492b43676f67494478795a57644259324e6c63334d67 595778736233646c5a44306964484a315a53497650676f4b504339475345686653553144556d566e 61584e30636e6b2b43673d3d3c2f4261736536343e0a20203c2f494d432d494d562d4d6573736167 653e0a0a20203c544e43432d544e43532d4d6573736167653e0a202020203c547970653e30303030 303030313c2f547970653e0a202020203c584d4c3e0a2020202020203c544e4361744648483e6265 74612076657273696f6e202d20646f206e6f742074727573743c2f544e4361744648483e0a202020 203c2f584d4c3e0a20203c2f544e43432d544e43532d4d6573 EAP-Message = 0x736167653e0a0a3c2f544e4343532d42617463683e0a Message-Authenticator = 0xe3a9f5b4cb73a9859e4222794943d68c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "Lumpy", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tnc rlm_eap: processing type tnc HANDLER_OPAQUE: 0 XXXXXXXXXXXX TNC-AUTHENTICATE is starting now for 0.......... Flags/Ver: 1 no data_length included Data received: (1028) SO /usr/local/fhh/NAA-TNCS/build/libNAA-TNCS.so found! TNCS is connected Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! GOT TNC_ConnectionState (juhuuu): 1 GOT State 1 from TNCS GOT Message from TNCS (length: 1114) outIsLengthIncluded: 0, outMoreFragments: 0, outOverallLength: 0 NEW STATE: 1 Set Reply->Code to EAP-REQUEST SET LENGTH: 1120 TYPE: EAP-TNC set Malloc 1120 bytes for packet Set Flags/Version: 1 Adding TNCCS-Data without Fragmentation TNCCS-Datalength: 1114 Packet built modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 40 to 25.20.227.141 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0102046026013c3f786d6c2076657273696f6e3d22312e302220656e 636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f22203f3e0a3c544e434353 2d426174636820426174636849643d22312220526563697069656e743d22544e43432220786d6c6e 733d22687474703a2f2f7777772e74727573746564636f6d707574696e6767726f75702e6f72672f 4957472f544e432f315f302f49465f544e434353232220786d6c6e733a7873693d22687474703a2f 2f7777772e74727573746564636f6d707574696e6767726f75702e6f72672f4957472f544e432f31 5f302f49465f544e434353232068747470733a2f2f7777772e EAP-Message = 0x74727573746564636f6d707574696e6767726f75702e6f72672f584d 4c2f534348454d412f544e4343535f312e302e787364223e0a0a20203c494d432d494d562d4d6573 736167653e0a202020203c547970653e46464646303033313c2f547970653e0a202020203c426173 6536343e5044393462577767646d567963326c76626a30694d5334774969426c626d4e765a476c75 5a7a3069565652474c54676949484e305957356b59577876626d5539496d35764969412f50676f38 526b684958306c4e566b68766333525459324675626d567949485a6c636e4e7062323439496a4575 4d43492b43676b386347397964484d2b43676b4a4943413863 EAP-Message = 0x47397964434275645731695a584939496a49784969382b43516f6749 434167504345744c53426d644841674c53302b43676b4a494341386347397964434275645731695a 584939496a49794969382b43516f6749434167504345744c53427a633267674c53302b43676b4a49 4341386347397964434275645731695a584939496a49314969382b43516f6749434167504345744c 53427a625852774943307450676f4a4353416750484276636e5167626e5674596d5679505349304d 69497650676b4b49434167494477684c533067626d46745a584e6c636e5a6c636941744c54344b43 516b674944787762334a304947353162574a6c636a30694e6a EAP-Message = 0x63694c7a344a43694167494341384953307449474a76623352776379 41764947526f593341674c53302b43676b4a494341386347397964434275645731695a584939496a 457a4e53497650676b4b49434167494477684c533067556c4244494556755a484276615735304945 31686348426c636941744c54344b435477766347397964484d2b43676f384c305a495346394a5456 5a4962334e3055324e68626d356c636a344b3c2f4261736536343e0a20203c2f494d432d494d562d 4d6573736167653e0a0a20203c544e43432d544e43532d4d6573736167653e0a202020203c547970 653e30303030303030313c2f547970653e0a202020203c584d EAP-Message = 0x4c3e0a2020202020203c544e4361744648483e626574612076657273 696f6e202d20646f206e6f742074727573743c2f544e4361744648483e0a202020203c2f584d4c3e 0a20203c2f544e43432d544e43532d4d6573736167653e0a0a3c2f544e4343532d42617463683e0a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcf3557a473bec4ac6a0a70a599c5e131 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 39 with timestamp 4708abbf Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 40 with timestamp 4708abc0 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 25.20.227.141:1645, id=41, length=1221 NAS-IP-Address = 25.20.227.141 NAS-Port = 50001 NAS-Port-Type = Ethernet User-Name = "Lumpy" Called-Station-Id = "00-15-62-BE-79-03" Calling-Station-Id = "00-15-58-7B-83-9D" Service-Type = Framed-User Framed-MTU = 1500 State = 0xcf3557a473bec4ac6a0a70a599c5e131 EAP-Message = 0x0202043826013c3f786d6c2076657273696f6e3d22312e302220656e 636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f22203f3e0a3c544e434353 2d426174636820426174636849643d22322220526563697069656e743d22544e43532220786d6c6e 733d22687474703a2f2f7777772e74727573746564636f6d707574696e6767726f75702e6f72672f 4957472f544e432f315f302f49465f544e434353232220786d6c6e733a7873693d22687474703a2f 2f7777772e74727573746564636f6d707574696e6767726f75702e6f72672f4957472f544e432f31 5f302f49465f544e434353232068747470733a2f2f7777772e EAP-Message = 0x74727573746564636f6d707574696e6767726f75702e6f72672f584d 4c2f534348454d412f544e4343535f312e302e787364223e0a0a20203c494d432d494d562d4d6573 736167653e0a202020203c547970653e46464646303033323c2f547970653e0a202020203c426173 6536343e5044393462577767646d567963326c76626a30694d5334774969426c626d4e765a476c75 5a7a3069565652474c54676949484e305957356b59577876626d5539496d35764969412f50676f38 526b684958306c4e513068766333525459324675626d567949485a6c636e4e7062323439496a4575 4d43492b43676f674944787762334a30637a344b4943416749 EAP-Message = 0x44787762334a304947353162574a6c636a30694d6a4569494739775a 573439496d5a6862484e6c4969382b43694167494341386347397964434275645731695a58493949 6a4979496942766347567550534a6d5957787a5a53497650676f674943416750484276636e516762 6e5674596d5679505349794e5349676233426c626a306964484a315a53496763325679646d6c6a5a 543069633231306343497650676f674943416750484276636e5167626e5674596d5679505349304d 6949676233426c626a30695a6d4673633255694c7a344b494341674944787762334a304947353162 574a6c636a30694e6a6369494739775a573439496d5a686248 EAP-Message = 0x4e6c4969382b43694167494341386347397964434275645731695a58 4939496a457a4e5349676233426c626a306964484a315a53496763325679646d6c6a5a5430695a58 4274595841694c7a344b494341384c334276636e527a50676f4b5043394753456866535531445347 397a64464e6a595735755a58492b43673d3d3c2f4261736536343e0a20203c2f494d432d494d562d 4d6573736167653e0a0a20203c544e43432d544e43532d4d6573736167653e0a202020203c547970 653e30303030303030313c2f547970653e0a202020203c584d4c3e0a2020202020203c544e436174 4648483e626574612076657273696f6e202d20646f206e6f74 EAP-Message = 0x2074727573743c2f544e4361744648483e0a202020203c2f584d4c3e 0a20203c2f544e43432d544e43532d4d6573736167653e0a0a3c2f544e4343532d42617463683e0a Message-Authenticator = 0x03896d48a518712015da804dbf894391 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "Lumpy", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tnc rlm_eap: processing type tnc HANDLER_OPAQUE: 0 XXXXXXXXXXXX TNC-AUTHENTICATE is starting now for 0.......... Flags/Ver: 1 no data_length included Data received: (1074) SO /usr/local/fhh/NAA-TNCS/build/libNAA-TNCS.so found! TNCS is connected Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! GOT TNC_ConnectionState (juhuuu): 1 GOT State 1 from TNCS GOT Message from TNCS (length: 598) outIsLengthIncluded: 0, outMoreFragments: 0, outOverallLength: 0 NEW STATE: 1 Set Reply->Code to EAP-REQUEST SET LENGTH: 604 TYPE: EAP-TNC set Malloc 604 bytes for packet Set Flags/Version: 1 Adding TNCCS-Data without Fragmentation TNCCS-Datalength: 598 Packet built modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 41 to 25.20.227.141 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0103025c26013c3f786d6c2076657273696f6e3d22312e302220656e 636f64696e673d225554462d3822207374616e64616c6f6e653d226e6f22203f3e3c544e4343532d 426174636820426174636849643d22332220526563697069656e743d22544e43432220786d6c6e73 3d22687474703a2f2f7777772e74727573746564636f6d707574696e6767726f75702e6f72672f49 57472f544e432f315f302f49465f544e434353232220786d6c6e733a7873693d22687474703a2f2f 7777772e74727573746564636f6d707574696e6767726f75702e6f72672f4957472f544e432f315f 302f49465f544e434353232068747470733a2f2f7777772e74 EAP-Message = 0x727573746564636f6d707574696e6767726f75702e6f72672f584d4c 2f534348454d412f544e4343535f312e302e787364223e0a0a20203c544e43432d544e43532d4d65 73736167653e0a202020203c547970653e30303030303030313c2f547970653e0a202020203c584d 4c3e0a2020202020203c544e4361744648483e626574612076657273696f6e202d20646f206e6f74 2074727573743c2f544e4361744648483e0a202020203c2f584d4c3e0a20203c2f544e43432d544e 43532d4d6573736167653e0a0a20203c544e43432d544e43532d4d6573736167653e0a202020203c 547970653e30303030303030313c2f547970653e0a20202020 EAP-Message = 0x3c584d4c3e0a2020202020203c544e4343532d5265636f6d6d656e64 6174696f6e20747970653d226e6f6e65222f3e0a202020203c2f584d4c3e0a20203c2f544e43432d 544e43532d4d6573736167653e0a0a3c2f544e4343532d42617463683e0a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbcb65528efe45909a32729180fc18f05 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 25.20.227.141:1645, id=42, length=139 NAS-IP-Address = 25.20.227.141 NAS-Port = 50001 NAS-Port-Type = Ethernet User-Name = "Lumpy" Called-Station-Id = "00-15-62-BE-79-03" Calling-Station-Id = "00-15-58-7B-83-9D" Service-Type = Framed-User Framed-MTU = 1500 State = 0xbcb65528efe45909a32729180fc18f05 EAP-Message = 0x020300062601 Message-Authenticator = 0xca70b9d228d7919940b38d5e824405e7 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "Lumpy", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 172 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tnc rlm_eap: processing type tnc HANDLER_OPAQUE: 0 XXXXXXXXXXXX TNC-AUTHENTICATE is starting now for 0.......... Flags/Ver: 1 no data_length included Data received: (0) SO /usr/local/fhh/NAA-TNCS/build/libNAA-TNCS.so found! TNCS is connected Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! Could not open file tnc_log.properties! GOT TNC_ConnectionState (juhuuu): 4 GOT State 4 from TNCS GOT Message from TNCS (length: 2) outIsLengthIncluded: 0, outMoreFragments: 0, outOverallLength: 0 NEW STATE: 4 SET LENGTH: 8 rlm_eap: Freeing handler Possible memory leak ... modcall[authenticate]: module "eap" returns reject for request 3 modcall: leaving group authenticate (returns reject) for request 3 auth: Failed to validate the user. Delaying request 3 for 1 seconds Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 25.20.227.141:1645, id=42, length=139 Sending Access-Reject of id 42 to 25.20.227.141 port 1645 EAP-Message = 0x04030004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Cleaning up request 2 ID 41 with timestamp 4708abc7 Cleaning up request 3 ID 42 with timestamp 4708abc7 Nothing to do. Sleeping until we see a request.

3 2

freeradius 1.0.2 with oracle backend
by Sam Gibbs 08 Oct '07

08 Oct '07

I've setup freeradius by following the "Using Oracle as a Backend DB for a Radius Server" document at www.ceta.ufm.edu.gt. The server will load the rlm_sql_oracle module and start. It is also communicating with the database properly. However, It will not authenticate users from that database. I get the following messages by watching the output of "radiusd -X" <snip> modcall[authorize]: module "sql" returns ok for request 8 modcall: group authorize returns ok for request 8 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 modcall[authenticate]: module "unix" returns notfound for request 8 modcall: group authenticate returns notfound for request 8 auth: Failed to validate the user. Delaying request 8 for 1 seconds Finished request 8 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 10.28.4.10:32770, id=13, length=102 Sending Access-Reject of id 13 to 10.28.4.10:32770 <snip> It will authenticate usernames that exist on the local system. It seems that it is defaulting to checking the password on the system instead of the password stored in the database table. Should I set a specific Auth-Type in the radreply table or is my problem due to misconfiguration of radiusd.conf? Thanks in advance, Sam

2 2

Freeradius with TTLS support
by José Antonio Olivera Ortega 08 Oct '07

08 Oct '07

Hello, I am trying to set up a freeradius server with EAP-TTLS authentication, Which are the steps to build freeradius with EAP-TTLS support? Can anybody help me? Thanks in advance & regards! -- José Antonio Olivera Ortega Automóvil Conectado - Telefónica I+D Teléfono: 913340330 Ext. 1000 Email: jaoo62(a)tid.es --

2 3

EAP/TLS certificate Security question
by satish patel 08 Oct '07

08 Oct '07

Dear all I have installed EAP/TLS base authentication in my wirless network i have some question about security issue i have installed certificate on every laptop of wirless client machine now thing is that is some one will installed that certificate on unknow client then how can i privent them if one if my company user give his/her certificate so some one or hacker then ??? is it possible i create certificate per user i genrate ceruficate per username thats why no bodya can give his/her certificate to untrusted party or anyother guys .....give me suggestion for this question how to more secure my wirless NETWORK.. $ cat ~/satish/url.txt http://www.linuxbug.org _____________________________________________________________________________________________________ --------------------------------- Unlimited freedom, unlimited storage. Get it now

2 1