October 2007 - Freeradius-Users - lists.freeradius.org

problem with proxying
by hacklberry 02 Nov '07

02 Nov '07

I wrote a little module for freeradius that is forwarding the incoming authentication requests to another server (to do the authentication). However I have to support proxying (in case there is a 3rd party RADIUS server). I can not take advantage of realms, because the users are login without any realm suffixes, prefixes, etc. (User bob simply uses username 'bob'). The problems is that bob can be a valid user on our server as well on the 3rd party RADIUS server. I tried to experiment with the Proxy-To-Realm attribute in the users file, but haven't had any luck either. Here is what I m trying to do: use my module rlm_xxx to authenticate user bob - if success i don't need anything else - if failure i want to proxy the authentication request to a 3rd party RADIUS server - if the authentication on the 3rd party RADIUS server succeeds I registered a post-proxy function in my module, where I m decreasing failed authentication count on the first server All these steps are working (separatelly) , but I m not able to make them work together, i.e. my authentication works, but no proxying, or the proxying works (when i setup the 3rd party RADIUS in the NULL realm) - but then my authentication against the first server is not called at all (my modules authenticate function is not called), the request is proxied without attempting my authentication function, only the post-proxy function on my module is called. I wonder if you could suggest how to configure freeradius to achieve what I m trying to do (if it is possible at all of course), cheers, martin

2 1

PAM_RADIUS_AUTH
by Sobanbabu Bakthavathsalu 02 Nov '07

02 Nov '07

Hi I am trying install the PAM_RADIUS_AUTH on a Solaris 10 server to use RADIUS for user authentication. I have managed to successfully compile and install the pam plugin. When I tried to telnet to the machine from a different server I am getting the following error. Failed looking up IP address for RADIUS server radius1 (errcode=12) I have made a host entry for this server name in /etc/hosts file and able to ping the RADIUS server with name. But still its not working. Could you please help on resolving this. Regards Soban **************** CAUTION - Disclaimer ***************** This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify the sender by e-mail and delete the original message. Further, you are not to copy, disclose, or distribute this e-mail or its contents to any other person and any such actions are unlawful. This e-mail may contain viruses. Infosys has taken every reasonable precaution to minimize this risk, but is not liable for any damage you may sustain as a result of any virus in this e-mail. You should carry out your own virus checks before opening the e-mail or attachment. Infosys reserves the right to monitor and review the content of all messages sent to or from this e-mail address. Messages sent to or from this e-mail address may be stored on the Infosys e-mail system. ***INFOSYS******** End of Disclaimer ********INFOSYS***

3 5

Basic usage: What do I do next to get this to work?
by Doc. Caliban 01 Nov '07

01 Nov '07

Hello, I hate to ask this, but I'm running out of time on this project and I'm completely new to RADIUS. I would be really happy if someone could just point me to a detailed HOW TO for what I need. I have freeRADIUS set up with an external MySQL user database and it's successfully authorizing requests from NTRadPing. Now I need to actually try it out "In the field". I need people running XP, Vista (ugh), and Apple laptops to be able to auth using the MySQL database that I have set up. So far I'm not having any luck, and I don't mind saying that I'm a little over my head at this point. Someone familiar with this will probably see glaring problems. I will provide all the details I can think of, but please let me know if you need more. Server: FreeRADIUS 1.1.7 with MySQL module. Database: Remote MySQL Access Point: D-Link DWL-7100AP (Ciscos coming in January) WPA-EAP TKIP Client Laptop: WPA Enterprise TKIP PEAP (Other options: EAP-SIM, TLS, TTLS, LEAP, EAP-FAST) MS-CHAP-V2 (Other options: GTC, TLS) I set up an AP to use RADIUS, and the requests get through to the RADIUS server, but they always fail. Posted below is the debug output from the failed attempt. > Ready to process requests. > rad_recv: Access-Request packet from host 192.168.0.1:1030, id=0, > length=193 > Message-Authenticator = 0xf9c41895a382161a1d31b4a47bd830e0 > Service-Type = Framed-User > User-Name = "testuser" > Framed-MTU = 1488 > Called-Station-Id = "00-11-95-DA-16-A6:SUSOM" > Calling-Station-Id = "00-1B-77-28-B3-CF" > NAS-Identifier = "D-Link Access Point" > NAS-Port-Type = Wireless-802.11 > Connect-Info = "CONNECT 54Mbps 802.11a" > EAP-Message = 0x0200000b01746261727468 > NAS-IP-Address = 192.168.0.1 > NAS-Port = 1 > NAS-Port-Id = "STA port # 1" > rad_lowerpair: User-Name now 'testuser' > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: EAP packet type response id 0 length 11 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 0 > radius_xlat: 'testuser' > rlm_sql (sql): sql_set_user escaped user --> 'testuser' > radius_xlat: 'SELECT id, UserName, Attribute, Value, op > FROM radcheck WHERE Username = 'testuser' ORDER BY id' > rlm_sql (sql): Reserving sql socket id: 4 > radius_xlat: 'SELECT > radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op > FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND > usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' > radius_xlat: 'SELECT id, UserName, Attribute, Value, op > FROM radreply WHERE Username = 'testuser' ORDER BY id' > radius_xlat: 'SELECT > radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op > FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND > usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' > rlm_sql (sql): Released sql socket id: 4 > modcall[authorize]: module "sql" returns ok for request 0 > rlm_pap: Found existing Auth-Type, not changing it. > modcall[authorize]: module "pap" returns noop for request 0 > modcall: leaving group authorize (returns updated) for request 0 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > rlm_eap: EAP Identity > rlm_eap: processing type md5 > rlm_eap_md5: Issuing Challenge > modcall[authenticate]: module "eap" returns handled for request 0 > modcall: leaving group authenticate (returns handled) for request 0 > Sending Access-Challenge of id 0 to 192.168.0.1 port 1030 > Framed-Protocol := PPP > Service-Type := Framed-User > Framed-MTU := 1500 > Framed-Compression := Van-Jacobson-TCP-IP > EAP-Message = 0x0101001604104e273ea966f4fb77466b296f9c607385 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x149370a5228b3ae0acdd9dc3fb4a25a4 > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 6 seconds... > rad_recv: Access-Request packet from host 192.168.0.1:1030, id=1, > length=206 > Message-Authenticator = 0xc9926863cf3df06ac150bbb6f77208eb > Service-Type = Framed-User > User-Name = "testuser" > Framed-MTU = 1488 > State = 0x149370a5228b3ae0acdd9dc3fb4a25a4 > Called-Station-Id = "00-11-95-DA-16-A6:SUSOM" > Calling-Station-Id = "00-1B-77-28-B3-CF" > NAS-Identifier = "D-Link Access Point" > NAS-Port-Type = Wireless-802.11 > Connect-Info = "CONNECT 54Mbps 802.11a" > EAP-Message = 0x020100060319 > NAS-IP-Address = 192.168.0.1 > NAS-Port = 1 > NAS-Port-Id = "STA port # 1" > rad_lowerpair: User-Name now 'testuser' > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 1 > modcall[authorize]: module "preprocess" returns ok for request 1 > modcall[authorize]: module "chap" returns noop for request 1 > modcall[authorize]: module "mschap" returns noop for request 1 > rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 1 > rlm_eap: EAP packet type response id 1 length 6 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 1 > radius_xlat: 'testuser' > rlm_sql (sql): sql_set_user escaped user --> 'testuser' > radius_xlat: 'SELECT id, UserName, Attribute, Value, op > FROM radcheck WHERE Username = 'testuser' ORDER BY id' > rlm_sql (sql): Reserving sql socket id: 3 > radius_xlat: 'SELECT > radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op > FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND > usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' > radius_xlat: 'SELECT id, UserName, Attribute, Value, op > FROM radreply WHERE Username = 'testuser' ORDER BY id' > radius_xlat: 'SELECT > radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op > FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND > usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' > rlm_sql (sql): Released sql socket id: 3 > modcall[authorize]: module "sql" returns ok for request 1 > rlm_pap: Found existing Auth-Type, not changing it. > modcall[authorize]: module "pap" returns noop for request 1 > modcall: leaving group authorize (returns updated) for request 1 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 1 > rlm_eap: Request found, released from the list > rlm_eap: EAP NAK > rlm_eap: EAP-NAK asked for EAP-Type/peap > rlm_eap: No such EAP type peap > rlm_eap: Failed in EAP select > modcall[authenticate]: module "eap" returns invalid for request 1 > modcall: leaving group authenticate (returns invalid) for request 1 > auth: Failed to validate the user. > Delaying request 1 for 1 seconds > Finished request 1 > Going to the next request > Waking up in 6 seconds... > rad_recv: Access-Request packet from host 192.168.0.1:1030, id=1, > length=206 > Sending Access-Reject of id 1 to 192.168.0.1 port 1030 > EAP-Message = 0x04010004 > Message-Authenticator = 0x00000000000000000000000000000000

6 28

SSL certificate problems
by Walter Gould 01 Nov '07

01 Nov '07

List, I am following the document "FreeRADIUS Active Directory Integration HOWTO" from the freeradius Wiki. I am having problems with creating SSL certificates. When I follow the instructions at the bottom of this doc and run the CA.all script, I see the following errors: + openssl pkcs12 -export -in demoCA/cacert.pem -inkey newreq.pem -out root.p12 -cacerts -passin pass:removed -passout pass:removed Error opening input file demoCA/cacert.pem demoCA/cacert.pem: No such file or directory + openssl pkcs12 -in root.p12 -out root.pem -passin pass:removed -passout pass:removed Error opening input file root.p12 root.p12: No such file or directory + openssl x509 -inform PEM -outform DER -in root.pem -out root.der Error opening Certificate root.pem 3925:error:02001002:system library:fopen:No such file or directory:bss_file.c:352:fopen('root.pem','r') 3925:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:354: unable to load certificate I saw a mailing list posting that said to move the CA.all script and the xpextensions file to the /etc/raddb/certs directory and run it from there, however after doing that I still receive the same errors. Anybody have any ideas on this? After googling awhile, it seems like this might be an openssl syntax error w/in the script. Also, I am using FreeRADIUS 1.1.3 (CentOS rpm install). Thanks, Walter

2 6

FreeRadius and Clean Access Manager
by Dorota Kupis 01 Nov '07

01 Nov '07

Hello, Has anybody set up FreeRadius with Network Admission Control. I have a trouble to set up FreeRadius as an authentication server in Clean Access Manager. It works perfectly with ACS. Thanks for a help Dorota

4 6

FreeRadius and Clean Access Manager
by Dorota Kupis 31 Oct '07

31 Oct '07

Hello, Has anybody set up FreeRadius with Network Admission Control. I have a trouble to set up FreeRadius as an authentication server in Clean Access Manager. It works perfectly with ACS. Thanks for a help Dorota

1 0

Signing a certificate
by Zolotov, Eyal 31 Oct '07

31 Oct '07

Hi, I'm trying to sign a certificate using OpenSSL. I got cacert.pem and a password from a 3rd patry. 1. Is it sufficient to sign certificates? 2. Shouldn't I have the cakey.pem as well? 2. Where should I put those files? Thanks, Eyal Zolotov. --------------------------------------------------------------------- Envara, Ltd. This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies.

1 0

access-deny reply log to mysql
by asd 31 Oct '07

31 Oct '07

I would like to log to radpostauth table inside the mysql server not only the Access-Accept replies but the Access-deny replies too. How to? thanks for helping Arjuna

1 0

R: Sqlippool & debian - sql_get_socket unresolved symbol
by Francesco Cristofori 31 Oct '07

31 Oct '07

Update: assigned bug number #448699 . http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=448699 Greetings, Francesco.

1 0

R: Sqlippool & debian - sql_get_socket unresolved symbol
by Francesco Cristofori 31 Oct '07

31 Oct '07

> Try editing the Makefiles so that rlm_sqlippool links to rlm_sql. > Maybe that will solve the problem. I tried to do this, but I'm not a good coder so I filed a bug against the debian package. > Alan DeKok. Thanks, Francesco.

1 0