October 2007 - Freeradius-Users - lists.freeradius.org

Supplicant seems not to send password user
by Ivan Kalik 03 Oct '07

03 Oct '07

OK. Had some time to look at your certificates. You have created a server certificate but not the (signed) root one. Instead you used and exported cacert. Also your server cert and private keys are separate while in your tls config you configured them as a same file. Have a look at CA.all script that comes with the freeradius distribution (or better use it) to see how it should be done. It places the key in the same file as the certificate. Ivan Kalik Kalik Informatika ISP

4 8

Conditional Proxy Radius
by Abdul Qadir 03 Oct '07

03 Oct '07

HI, I am using freeradius with SER. In simple words i want to proxy radius based on user id instead of realm. Also want to add some extra functionality before I do the proxy. My requirements are as follows I have two different types of users. Some users have numeric user id and some have Alphanumeric. E.g 123456(a)mydomain.com and abdefghijk(a)mydomain.com I would like to configure my radius server as 1. If user id is numeric. i.e 123456(a)mydomain.com Query local database for authentication. 2. If user id is alphanumeric i.e abdefghijk(a)mydomain.com 2.1 First Query local database to get new realm value for this user id. eg. database query will return me abdefghijk(a)RemoteDomain.com 2.3 Proxy the new URI to another radius. Please suggest whether its possible to do so, if yes what is the procedure. And which version of FreeRadius support this kind of functionality. Thanking you in advance. Best Regards, Abdul Qadir --------------------------------- Catch up on fall's hot new shows on Yahoo! TV. Watch previews, get listings, and more!

2 1

Freeradius + TTLS Support Failure
by José Antonio Olivera Ortega 03 Oct '07

03 Oct '07

Hello, I am getting up a Freeradius server with ttls support. I have built the Debian package with ttsl support but when I try to test it I get the following output: #freeradius -X Starting - reading configuration files ... [...] Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32775, id=187, length=56 User-Name = "test" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 Segmentation fault # I don't know what is the problem, I have been surfing Internet and I have not found any resources to resolve the failure, Please, could you help me? I look forward to hearing from you soon. Respectfully, Jose Antonio -- José Antonio Olivera Ortega Automóvil Conectado - Telefónica I+D Teléfono: 913340330 Ext. 1000 Email: jaoo62(a)tid.es --

2 3

RE: Mutual Authentication with EAP-TTLS/MSCHAPv2
by Josh Howlett 03 Oct '07

03 Oct '07

> 1. Does EAP-TTLS with MSCHAPv2 considered as a mutual > authentication method? It is probably best if you read RFC4017 for a full discussion of mutual authentication in the EAP context. FWIW, the short answer is "yes, it can be used in this way". > 2. I understand that the TTLS itself can be mutual, meaning: > > a. The client authenticates the server (via server certificate) Yes. > b. A secured tunnel is created > > c. The server authenticates the client (via client certificate) Yes, this is possible but not necessary, because as you say... > d. The client authenticates itself again using MSCHAPv2. e. The server also authenticates itself using MSCHAPv2. A challenge-response is piggy-backed on the MSCHAP exchange. > Does FreeRadius support this kind of Authentication? Yes. > 3. I received a root-certificate and I want to create trusted > certificates. > > a. Which software can I use sign a certificate > with the root-certificate I received? I doubt you received a root CA certificate. You probably got issued with a certificate signed by the root or an intermediate CA. However, I'm speculating - it is probably best to ask whomever provided the certificate directly. It is essential to understand precisely what is going on, because it is very easy to make mistakes with PKI... best regards, josh. JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG

1 0

LOGs of free radius
by anoop_c＠sifycorp.com 03 Oct '07

03 Oct '07

Hi I am doing eap-tls authentication with free radius.I am getting tow log files which are radius.log and radwatch.log. Can anyone tell me how to rotate theses log file. I don\'t want the radwatch.log also .How can i remoce this radwach.log Regards Anoop

3 2

Re: unsubscribe
by Live Great 03 Oct '07

03 Oct '07

Can you please stop sending this email to the group? Thank you Sam ----- Original Message ---- From: John Wan <J.Wan(a)mbs.edu> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, October 2, 2007 4:12:29 PM Subject: unsubscribe John Wan Project Manager (DMZ project), Information Technology Services Melbourne Business School T: +61 3 9349 8428 F: +61 3 9349 8433 M: 0419 349 339 Please consider the environment before printing this email > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of > Alan DeKok > Sent: Tuesday, 2 October 2007 3:06 PM > To: FreeRadius users mailing list > Subject: Re: Shared Secret > > Cesar De la Hoz wrote: > > I want to setup a Client in my server by only setting his IP, and not caring about the share secret he's using. Is this > possible ? > > No. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- _______________________________________________________________________________ Notice from Melbourne Business School Ltd The information contained in this e-mail is confidential, and is intended for the named person's use only. It may contain proprietary or legally privileged information. If you have received this email in error, please notify the sender and delete it immediately. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient Internet communications are not secure. You should scan this message and any attachments for viruses. Melbourne Business School does not accept any liability for loss or damage which may result from receipt of this message or any attachments. ______________________________________________________________________________ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Questions on Acct-Interim-Interval
by Vinay Wagh 03 Oct '07

03 Oct '07

Hi, A couple of questions on Acct-Interim-Interval 1. I wanted to know if the Acct-Interim update that comes from the NAS has any relevance as far as the user session maintained in the radius server is concerned. Meaning that is it treated like a keep-alive of some sort. If the Acct-Interim-Interval is configured to be 100 seconds and the NAS sends the Interim-Update after 200 seconds does the freeradius server care ? 2. What is the typical value of this attribute, I ask because if this value is configured to be small then it will generate a lot of interim updates from a NAS that supports large number of subscribers. At the same time I am not sure how the service providers who deploy the server use this Attribute and how often do they want the updates. Thanks, Vinay

3 2

More debug info about LDAP?
by rickan 02 Oct '07

02 Oct '07

Hi guys, I am trying to establish a secure connection between freeradius and a Novell eDirectory LDAP server. After configuring LDAP in radiusd.conf it seemed to work, almost: rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.1.5:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /usr/local/etc/raddb/ldap_ca_cert.pem rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: ldap_start_tls_s() rlm_ldap: could not start TLS Operations error rlm_ldap: (re)connection attempt failed Because I don't know how to get logs from the eDirectory side, I recorded the traffic between both hosts and saw that the TLS handshake had been done, both mashines had exchanged cipher key and begun to send data. After 3 or 4 packets the LDAP server sent a "encrypted alert" and disconnected. Since these data are encrypted I could not see what happened indeed. My question: is it possible to get more debug info from the freeradius side? If yes, how? Thanks, Rickan

2 1

FreeRADIUS TLS certificate signing
by Chris Byrd 02 Oct '07

02 Oct '07

Can someone on the list share with me their experience with certificate signing? I'd like to submit a CSR to a commercial signing authority such as GoDaddy so that wireless clients can establish a TLS session with a trusted certificate. Is this as simple as: openssl genrsa -out radius.key 1024 openssl req -new -key radius.key -out radius.csr Then submitting the CSR to the signing authority? My biggest concern is if the signing authority will add the Enhanced Key Usage parameters necessary to support Windows clients. I think I read that they add it to support SSL web servers, but I haven't been able to find that reference again. Also, in my testing it appears that unlike with web servers, it doesn't really matter what CN you use - since clients aren't resolving DNS at that point, it appears from my testing that they take any cert signed by a trusted signing authority, and don't do the standard check of FQDN == CN. Does that sound right? Thanks in advance, Chris

3 2

Supplicant seems not to send password user
by Sergio Belkin 02 Oct '07

02 Oct '07

2007/10/1, tnt(a)kalik.co.yu <tnt(a)kalik.co.yu>: > If you have used CA.all or certs.sh they should all be created. You > should have your root certs, server certs and client certs. You need to > import root (into Trusted Root CAs) and client (only if you are using > TLS) certificates onto the (XP, don't now for Linux) client machine. > You should have both .pem and .der (and p12) versions of those > certificates created. > > Ivan Kalik > Kalik Informatika ISP I tested with a wrong passwd problem is the same, so I think that Windows is not sending password user. Why? The output of tcpdum -vvv port 1812 is like so: 16:28:15.887844 IP (tos 0x0, ttl 64, id 52184, offset 0, flags [DF], proto 17, length: 126) ap.cadorna.edu.1036 > lala.cadorna.edu.radius: RADIUS, length: 98 Access Request (1), id: 0x21, Authenticator: 7a871d92f8f77eda1093c5ad8505716f Username Attribute (1), length: 6, Value: test 0x0000: 7465 7374 Calling Station Attribute (31), length: 19, Value: 00-0e-35-bf-51-18 0x0000: 3030 2d30 652d 3335 2d62 662d 3531 2d31 0x0010: 38 [|radius] 16:28:15.888820 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto 17, length: 103) lala.cadorna.edu.radius > ap.cadorna.edu.1036: RADIUS, length: 75 Access Challenge (11), id: 0x21, Authenticator: dc75cc743b219ca824fe2ee823c0665d Reply Attribute (18), length: 11, Value: Hola test 0x0000: 486f 6c61 2074 6573 74 EAP Message Attribute (79), length: 8, Value: .. 0x0000: 0102 0006 1920 [|radius] 16:28:15.976539 IP (tos 0x0, ttl 64, id 52185, offset 0, flags [DF], proto 17, length: 215) ap.cadorna.edu.1036 > lala.cadorna.edu.radius: RADIUS, length: 187 Access Request (1), id: 0x22, Authenticator: 0e44d85458ccc2059649d4175a323112 Username Attribute (1), length: 6, Value: test 0x0000: 7465 7374 Calling Station Attribute (31), length: 19, Value: 00-0e-35-bf-51-18 0x0000: 3030 2d30 652d 3335 2d62 662d 3531 2d31 0x0010: 38 [|radius] 16:28:15.978521 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto 17, length: 1005) lala.cadorna.edu.radius > ap.cadorna.edu.1036: RADIUS, length: 977 Access Challenge (11), id: 0x22, Authenticator: 438fc0ca6183f13c6c2e342291dc8ebe Reply Attribute (18), length: 11, Value: Hola test 0x0000: 486f 6c61 2074 6573 74 [|radius] 16:28:16.225632 IP (tos 0x0, ttl 64, id 52186, offset 0, flags [DF], proto 17, length: 141) ap.cadorna.edu.1036 > lala.cadorna.edu.radius: RADIUS, length: 113 Access Request (1), id: 0x23, Authenticator: 667c0a16eefc30863e6e658cdeae467c Username Attribute (1), length: 6, Value: test 0x0000: 7465 7374 Calling Station Attribute (31), length: 19, Value: 00-0e-35-bf-51-18 0x0000: 3030 2d30 652d 3335 2d62 662d 3531 2d31 0x0010: 38 EAP Message Attribute (79), length: 8, Value: .. 0x0000: 0203 0006 1900 Framed MTU Attribute (12), zero-length 16:28:16.226297 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto 17, length: 103) lala.cadorna.edu.radius > ap.cadorna.edu.1036: RADIUS, length: 75 Access Challenge (11), id: 0x23, Authenticator: 53b1bf433e29c70acbced5a765d7bf09 Reply Attribute (18), length: 11, Value: Hola test 0x0000: 486f 6c61 2074 6573 74 EAP Message Attribute (79), length: 8, Value: .. 0x0000: 0104 0006 1900 [|radius] 16:28:22.551919 IP (tos 0x0, ttl 64, id 52187, offset 0, flags [DF], proto 17, length: 126) ap.cadorna.edu.1036 > lala.cadorna.edu.radius: RADIUS, length: 98 Access Request (1), id: 0x24, Authenticator: 75f542cb04eabb083f559c6440d3902c Username Attribute (1), length: 6, Value: test 0x0000: 7465 7374 Calling Station Attribute (31), length: 19, Value: 00-0e-35-bf-51-18 0x0000: 3030 2d30 652d 3335 2d62 662d 3531 2d31 0x0010: 38 [|radius] 16:28:22.553033 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto 17, length: 103) lala.cadorna.edu.radius > ap.cadorna.edu.1036: RADIUS, length: 75 Access Challenge (11), id: 0x24, Authenticator: 7b9032bce20a9dd6548378e5b14013df Reply Attribute (18), length: 11, Value: Hola test 0x0000: 486f 6c61 2074 6573 74 EAP Message Attribute (79), length: 8, Value: .. 0x0000: 0102 0006 1920 [|radius] 16:28:22.644487 IP (tos 0x0, ttl 64, id 52188, offset 0, flags [DF], proto 17, length: 215) ap.cadorna.edu.1036 > lala.cadorna.edu.radius: RADIUS, length: 187 Access Request (1), id: 0x25, Authenticator: e0c1258190abbd760f75c0f340f8f237 Username Attribute (1), length: 6, Value: test 0x0000: 7465 7374 Calling Station Attribute (31), length: 19, Value: 00-0e-35-bf-51-18 0x0000: 3030 2d30 652d 3335 2d62 662d 3531 2d31 0x0010: 38 [|radius] 16:28:22.646339 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto 17, length: 1005) lala.cadorna.edu.radius > ap.cadorna.edu.1036: RADIUS, length: 977 Access Challenge (11), id: 0x25, Authenticator: 4254b90367630f81c346b0f4fb8c2ea4 Reply Attribute (18), length: 11, Value: Hola test 0x0000: 486f 6c61 2074 6573 74 [|radius] 16:28:22.874218 IP (tos 0x0, ttl 64, id 52189, offset 0, flags [DF], proto 17, length: 141) ap.cadorna.edu.1036 > lala.cadorna.edu.radius: RADIUS, length: 113 Access Request (1), id: 0x26, Authenticator: 85edad2f0655d93d0cc977d9eb0e73e2 Username Attribute (1), length: 6, Value: test 0x0000: 7465 7374 Calling Station Attribute (31), length: 19, Value: 00-0e-35-bf-51-18 0x0000: 3030 2d30 652d 3335 2d62 662d 3531 2d31 0x0010: 38 EAP Message Attribute (79), length: 8, Value: .. 0x0000: 0203 0006 1900 Framed MTU Attribute (12), zero-length 16:28:22.875215 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto 17, length: 103) lala.cadorna.edu.radius > ap.cadorna.edu.1036: RADIUS, length: 75 Access Challenge (11), id: 0x26, Authenticator: 793f2729e3ba111bd4ebf72b7c30cdd9 Reply Attribute (18), length: 11, Value: Hola test 0x0000: 486f 6c61 2074 6573 74 EAP Message Attribute (79), length: 8, Value: .. 0x0000: 0104 0006 1900 [|radius] 16:28:30.657219 IP (tos 0x0, ttl 64, id 52190, offset 0, flags [DF], proto 17, length: 126) ap.cadorna.edu.1036 > lala.cadorna.edu.radius: RADIUS, length: 98 Access Request (1), id: 0x27, Authenticator: a3ce2ab23845827b5deefe7d95a68d5a Username Attribute (1), length: 6, Value: test 0x0000: 7465 7374 Calling Station Attribute (31), length: 19, Value: 00-0e-35-bf-51-18 0x0000: 3030 2d30 652d 3335 2d62 662d 3531 2d31 0x0010: 38 [|radius] 16:28:30.658187 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto 17, length: 103) lala.cadorna.edu.radius > ap.cadorna.edu.1036: RADIUS, length: 75 Access Challenge (11), id: 0x27, Authenticator: b927521793668b8c495633b16acbfe2c Reply Attribute (18), length: 11, Value: Hola test 0x0000: 486f 6c61 2074 6573 74 EAP Message Attribute (79), length: 8, Value: .. 0x0000: 0102 0006 1920 [|radius] 16:28:30.768899 IP (tos 0x0, ttl 64, id 52191, offset 0, flags [DF], proto 17, length: 215) ap.cadorna.edu.1036 > lala.cadorna.edu.radius: RADIUS, length: 187 Access Request (1), id: 0x28, Authenticator: afcc2a89d9514fba93e7f196de92c18e Username Attribute (1), length: 6, Value: test 0x0000: 7465 7374 Calling Station Attribute (31), length: 19, Value: 00-0e-35-bf-51-18 0x0000: 3030 2d30 652d 3335 2d62 662d 3531 2d31 0x0010: 38 [|radius] 16:28:30.770865 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto 17, length: 1005) lala.cadorna.edu.radius > ap.cadorna.edu.1036: RADIUS, length: 977 Access Challenge (11), id: 0x28, Authenticator: 4a9375a56f69dcb9f82863870747ffa9 Reply Attribute (18), length: 11, Value: Hola test 0x0000: 486f 6c61 2074 6573 74 [|radius] 16:28:31.066463 IP (tos 0x0, ttl 64, id 52192, offset 0, flags [DF], proto 17, length: 141) ap.cadorna.edu.1036 > lala.cadorna.edu.radius: RADIUS, length: 113 Access Request (1), id: 0x29, Authenticator: 81bb5b35b0edecb0df1a04edcf1a52bf Username Attribute (1), length: 6, Value: test 0x0000: 7465 7374 Calling Station Attribute (31), length: 19, Value: 00-0e-35-bf-51-18 0x0000: 3030 2d30 652d 3335 2d62 662d 3531 2d31 0x0010: 38 EAP Message Attribute (79), length: 8, Value: .. 0x0000: 0203 0006 1900 Framed MTU Attribute (12), zero-length 16:28:31.067500 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto 17, length: 103) lala.cadorna.edu.radius > ap.cadorna.edu.1036: RADIUS, length: 75 Access Challenge (11), id: 0x29, Authenticator: f93c8740cfa46b36a91351f3a61253b6 Reply Attribute (18), length: 11, Value: Hola test 0x0000: 486f 6c61 2074 6573 74 EAP Message Attribute (79), length: 8, Value: .. 0x0000: 0104 0006 1900 [|radius] 16:28:37.873824 IP (tos 0x0, ttl 64, id 52193, offset 0, flags [DF], proto 17, length: 126) ap.cadorna.edu.1036 > lala.cadorna.edu.radius: RADIUS, length: 98 Access Request (1), id: 0x2a, Authenticator: eeacf6a86e7905ed7fc83e57a83a9858 Username Attribute (1), length: 6, Value: test 0x0000: 7465 7374 Calling Station Attribute (31), length: 19, Value: 00-0e-35-bf-51-18 0x0000: 3030 2d30 652d 3335 2d62 662d 3531 2d31 0x0010: 38 [|radius] 16:28:37.874881 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto 17, length: 103) lala.cadorna.edu.radius > ap.cadorna.edu.1036: RADIUS, length: 75 Access Challenge (11), id: 0x2a, Authenticator: fa3868e5a85025b1eaee49d8afc26038 Reply Attribute (18), length: 11, Value: Hola test 0x0000: 486f 6c61 2074 6573 74 EAP Message Attribute (79), length: 8, Value: .. 0x0000: 0102 0006 1920 [|radius] 16:28:37.991001 IP (tos 0x0, ttl 64, id 52194, offset 0, flags [DF], proto 17, length: 215) ap.cadorna.edu.1036 > lala.cadorna.edu.radius: RADIUS, length: 187 Access Request (1), id: 0x2b, Authenticator: 47aa2625439793582ad8f3a47915ff6b Username Attribute (1), length: 6, Value: test 0x0000: 7465 7374 Calling Station Attribute (31), length: 19, Value: 00-0e-35-bf-51-18 0x0000: 3030 2d30 652d 3335 2d62 662d 3531 2d31 0x0010: 38 [|radius] 16:28:37.992911 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto 17, length: 1005) lala.cadorna.edu.radius > ap.cadorna.edu.1036: RADIUS, length: 977 Access Challenge (11), id: 0x2b, Authenticator: dec47ad9c4c944c02b707320066fb95e Reply Attribute (18), length: 11, Value: Hola test 0x0000: 486f 6c61 2074 6573 74 [|radius] 16:28:38.244467 IP (tos 0x0, ttl 64, id 52195, offset 0, flags [DF], proto 17, length: 141) ap.cadorna.edu.1036 > lala.cadorna.edu.radius: RADIUS, length: 113 Access Request (1), id: 0x2c, Authenticator: 9e84332832573fdedb117de81ca8d5da Username Attribute (1), length: 6, Value: test 0x0000: 7465 7374 Calling Station Attribute (31), length: 19, Value: 00-0e-35-bf-51-18 0x0000: 3030 2d30 652d 3335 2d62 662d 3531 2d31 0x0010: 38 EAP Message Attribute (79), length: 8, Value: .. 0x0000: 0203 0006 1900 Framed MTU Attribute (12), zero-length 16:28:38.245479 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto 17, length: 103) lala.cadorna.edu.radius > ap.cadorna.edu.1036: RADIUS, length: 75 Access Challenge (11), id: 0x2c, Authenticator: d8fb757098c06d341967e325b120492f Reply Attribute (18), length: 11, Value: Hola test 0x0000: 486f 6c61 2074 6573 74 EAP Message Attribute (79), length: 8, Value: .. 0x0000: 0104 0006 1900 [|radius] > > > Dana 1/10/2007, "Sergio Belkin" <sebelk(a)gmail.com> piše: > > >2007/10/1, tnt(a)kalik.co.yu <tnt(a)kalik.co.yu>: > >> > I've imported cacert.pem both Windows XP and Linux too. > >> > >> I was under the impression that Windows doesn't accept .pem but need > >> der certificates. Linux debug also complains about CA certificate. > >> Latest server distribution has scripts to set this up. > >> > >> Ivan Kalik > >> Kalik Informatika ISP > >> > >> - > >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >> > > > >Thanks Ivan, > >Can I convert each certificate or should I create them again? > >-- > >-- > >Sergio Belkin - > >- > >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > -- -- Sergio Belkin -

2 5