November 2007 - Freeradius-Users - lists.freeradius.org

Filtering out a attribute conditionally
by Mike O'Connor 03 Nov '07

03 Nov '07

Hi All I have a problem with my Cisco 7301's where I apply a address pool via a Cisco-AVPair (for each wholesale ISP customer) and the wholesale ISP supplies a Framed-IP-Address at the same time, the connection is kicked by the cisco. Is there any way of adding or removing the ip_pool bases on a rule ? Could Freeradius 2 do this ? Thanks Mike --- Current Attrs File xxxx.com Service-Type == Framed-User, Framed-IP-Address =* 255.255.255.254, Framed-IP-Netmask == 255.255.255.255, Framed-Route =* ANY, Cisco-AVPair := "ip:addr-pool=ip_pool_netyp", Framed-Compression =* Van-Jacobson-TCP-IP, Framed-Protocol == PPP, Framed-MTU =* 1492, Framed-Filter-ID =* ANY, Cisco-AVPair =* ANY, Reply-Message =* ANY, Proxy-State =* ANY, Idle-Timeout =* 600, Session-Timeout =* 28800, Port-Limit =* 1 --- Reply with out framed-ip-address Packet-Type = Access-Accept Wed Oct 31 19:55:36 2007 Cisco-AVPair := "ip:addr-pool=ip_pool_netyp" Service-Type = Framed-User Framed-Protocol = PPP Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Session-Timeout = 14400 Idle-Timeout = 900 Port-Limit = 1 --- Reply with framed-ip-address Packet-Type = Access-Accept Wed Oct 31 19:55:36 2007 Cisco-AVPair := "ip:addr-pool=ip_pool_netyp" Service-Type = Framed-User Framed-IP-Address = XXX.XXX.11.247 Framed-IP-Netmask = 255.255.255.255 Framed-Protocol = PPP Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Session-Timeout = 14400 Idle-Timeout = 900 Port-Limit = 1

2 2

How to proxy password from TTLS
by Wolfgang Burger 02 Nov '07

02 Nov '07

Hi, I have a working configuration of FreeRADIUS configured for EAP-TLS. I´m trying to add support for EAP-TTLS and I want to proxy the username and password of the inner TTLS session to another Radius-Server. Client doing TTLS --> FreeRADIUS --> 3rd-Party Backend-Server with database of Users Forwarding of the packets is working. The Access-Request that FreeRADIUS sends to the backend-server uses the username entered at the client, but no password at all. If i add User-Password := "validpassword" to preproxy_users, where "validpassword" is the valid password for the given username on the Backend-Server, everything works. What do I have to change, to use the password transmitted in the TTLS-Tunnel? Or do I have fundamental errors in my idea of how to do this? Any help is very welcome. Greetings, Wolfgang Burger <burgerw(a)immunbio.mpg.de> Max-Planck-Institut fuer Immunbiologie Scientific Data Processing Unit (+00 49) 761 / 5108 461 Stuebeweg 51 D-79108 Freiburg Germany

3 7

problem with proxying
by hacklberry 02 Nov '07

02 Nov '07

I wrote a little module for freeradius that is forwarding the incoming authentication requests to another server (to do the authentication). However I have to support proxying (in case there is a 3rd party RADIUS server). I can not take advantage of realms, because the users are login without any realm suffixes, prefixes, etc. (User bob simply uses username 'bob'). The problems is that bob can be a valid user on our server as well on the 3rd party RADIUS server. I tried to experiment with the Proxy-To-Realm attribute in the users file, but haven't had any luck either. Here is what I m trying to do: use my module rlm_xxx to authenticate user bob - if success i don't need anything else - if failure i want to proxy the authentication request to a 3rd party RADIUS server - if the authentication on the 3rd party RADIUS server succeeds I registered a post-proxy function in my module, where I m decreasing failed authentication count on the first server All these steps are working (separatelly) , but I m not able to make them work together, i.e. my authentication works, but no proxying, or the proxying works (when i setup the 3rd party RADIUS in the NULL realm) - but then my authentication against the first server is not called at all (my modules authenticate function is not called), the request is proxied without attempting my authentication function, only the post-proxy function on my module is called. I wonder if you could suggest how to configure freeradius to achieve what I m trying to do (if it is possible at all of course), cheers, martin

2 1

PAM_RADIUS_AUTH
by Sobanbabu Bakthavathsalu 02 Nov '07

02 Nov '07

Hi I am trying install the PAM_RADIUS_AUTH on a Solaris 10 server to use RADIUS for user authentication. I have managed to successfully compile and install the pam plugin. When I tried to telnet to the machine from a different server I am getting the following error. Failed looking up IP address for RADIUS server radius1 (errcode=12) I have made a host entry for this server name in /etc/hosts file and able to ping the RADIUS server with name. But still its not working. Could you please help on resolving this. Regards Soban **************** CAUTION - Disclaimer ***************** This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify the sender by e-mail and delete the original message. Further, you are not to copy, disclose, or distribute this e-mail or its contents to any other person and any such actions are unlawful. This e-mail may contain viruses. Infosys has taken every reasonable precaution to minimize this risk, but is not liable for any damage you may sustain as a result of any virus in this e-mail. You should carry out your own virus checks before opening the e-mail or attachment. Infosys reserves the right to monitor and review the content of all messages sent to or from this e-mail address. Messages sent to or from this e-mail address may be stored on the Infosys e-mail system. ***INFOSYS******** End of Disclaimer ********INFOSYS***

3 5

Basic usage: What do I do next to get this to work?
by Doc. Caliban 01 Nov '07

01 Nov '07

Hello, I hate to ask this, but I'm running out of time on this project and I'm completely new to RADIUS. I would be really happy if someone could just point me to a detailed HOW TO for what I need. I have freeRADIUS set up with an external MySQL user database and it's successfully authorizing requests from NTRadPing. Now I need to actually try it out "In the field". I need people running XP, Vista (ugh), and Apple laptops to be able to auth using the MySQL database that I have set up. So far I'm not having any luck, and I don't mind saying that I'm a little over my head at this point. Someone familiar with this will probably see glaring problems. I will provide all the details I can think of, but please let me know if you need more. Server: FreeRADIUS 1.1.7 with MySQL module. Database: Remote MySQL Access Point: D-Link DWL-7100AP (Ciscos coming in January) WPA-EAP TKIP Client Laptop: WPA Enterprise TKIP PEAP (Other options: EAP-SIM, TLS, TTLS, LEAP, EAP-FAST) MS-CHAP-V2 (Other options: GTC, TLS) I set up an AP to use RADIUS, and the requests get through to the RADIUS server, but they always fail. Posted below is the debug output from the failed attempt. > Ready to process requests. > rad_recv: Access-Request packet from host 192.168.0.1:1030, id=0, > length=193 > Message-Authenticator = 0xf9c41895a382161a1d31b4a47bd830e0 > Service-Type = Framed-User > User-Name = "testuser" > Framed-MTU = 1488 > Called-Station-Id = "00-11-95-DA-16-A6:SUSOM" > Calling-Station-Id = "00-1B-77-28-B3-CF" > NAS-Identifier = "D-Link Access Point" > NAS-Port-Type = Wireless-802.11 > Connect-Info = "CONNECT 54Mbps 802.11a" > EAP-Message = 0x0200000b01746261727468 > NAS-IP-Address = 192.168.0.1 > NAS-Port = 1 > NAS-Port-Id = "STA port # 1" > rad_lowerpair: User-Name now 'testuser' > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: EAP packet type response id 0 length 11 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 0 > radius_xlat: 'testuser' > rlm_sql (sql): sql_set_user escaped user --> 'testuser' > radius_xlat: 'SELECT id, UserName, Attribute, Value, op > FROM radcheck WHERE Username = 'testuser' ORDER BY id' > rlm_sql (sql): Reserving sql socket id: 4 > radius_xlat: 'SELECT > radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op > FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND > usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' > radius_xlat: 'SELECT id, UserName, Attribute, Value, op > FROM radreply WHERE Username = 'testuser' ORDER BY id' > radius_xlat: 'SELECT > radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op > FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND > usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' > rlm_sql (sql): Released sql socket id: 4 > modcall[authorize]: module "sql" returns ok for request 0 > rlm_pap: Found existing Auth-Type, not changing it. > modcall[authorize]: module "pap" returns noop for request 0 > modcall: leaving group authorize (returns updated) for request 0 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > rlm_eap: EAP Identity > rlm_eap: processing type md5 > rlm_eap_md5: Issuing Challenge > modcall[authenticate]: module "eap" returns handled for request 0 > modcall: leaving group authenticate (returns handled) for request 0 > Sending Access-Challenge of id 0 to 192.168.0.1 port 1030 > Framed-Protocol := PPP > Service-Type := Framed-User > Framed-MTU := 1500 > Framed-Compression := Van-Jacobson-TCP-IP > EAP-Message = 0x0101001604104e273ea966f4fb77466b296f9c607385 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x149370a5228b3ae0acdd9dc3fb4a25a4 > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 6 seconds... > rad_recv: Access-Request packet from host 192.168.0.1:1030, id=1, > length=206 > Message-Authenticator = 0xc9926863cf3df06ac150bbb6f77208eb > Service-Type = Framed-User > User-Name = "testuser" > Framed-MTU = 1488 > State = 0x149370a5228b3ae0acdd9dc3fb4a25a4 > Called-Station-Id = "00-11-95-DA-16-A6:SUSOM" > Calling-Station-Id = "00-1B-77-28-B3-CF" > NAS-Identifier = "D-Link Access Point" > NAS-Port-Type = Wireless-802.11 > Connect-Info = "CONNECT 54Mbps 802.11a" > EAP-Message = 0x020100060319 > NAS-IP-Address = 192.168.0.1 > NAS-Port = 1 > NAS-Port-Id = "STA port # 1" > rad_lowerpair: User-Name now 'testuser' > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 1 > modcall[authorize]: module "preprocess" returns ok for request 1 > modcall[authorize]: module "chap" returns noop for request 1 > modcall[authorize]: module "mschap" returns noop for request 1 > rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 1 > rlm_eap: EAP packet type response id 1 length 6 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 1 > radius_xlat: 'testuser' > rlm_sql (sql): sql_set_user escaped user --> 'testuser' > radius_xlat: 'SELECT id, UserName, Attribute, Value, op > FROM radcheck WHERE Username = 'testuser' ORDER BY id' > rlm_sql (sql): Reserving sql socket id: 3 > radius_xlat: 'SELECT > radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op > FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND > usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' > radius_xlat: 'SELECT id, UserName, Attribute, Value, op > FROM radreply WHERE Username = 'testuser' ORDER BY id' > radius_xlat: 'SELECT > radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op > FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND > usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' > rlm_sql (sql): Released sql socket id: 3 > modcall[authorize]: module "sql" returns ok for request 1 > rlm_pap: Found existing Auth-Type, not changing it. > modcall[authorize]: module "pap" returns noop for request 1 > modcall: leaving group authorize (returns updated) for request 1 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 1 > rlm_eap: Request found, released from the list > rlm_eap: EAP NAK > rlm_eap: EAP-NAK asked for EAP-Type/peap > rlm_eap: No such EAP type peap > rlm_eap: Failed in EAP select > modcall[authenticate]: module "eap" returns invalid for request 1 > modcall: leaving group authenticate (returns invalid) for request 1 > auth: Failed to validate the user. > Delaying request 1 for 1 seconds > Finished request 1 > Going to the next request > Waking up in 6 seconds... > rad_recv: Access-Request packet from host 192.168.0.1:1030, id=1, > length=206 > Sending Access-Reject of id 1 to 192.168.0.1 port 1030 > EAP-Message = 0x04010004 > Message-Authenticator = 0x00000000000000000000000000000000

6 28

SSL certificate problems
by Walter Gould 01 Nov '07

01 Nov '07

List, I am following the document "FreeRADIUS Active Directory Integration HOWTO" from the freeradius Wiki. I am having problems with creating SSL certificates. When I follow the instructions at the bottom of this doc and run the CA.all script, I see the following errors: + openssl pkcs12 -export -in demoCA/cacert.pem -inkey newreq.pem -out root.p12 -cacerts -passin pass:removed -passout pass:removed Error opening input file demoCA/cacert.pem demoCA/cacert.pem: No such file or directory + openssl pkcs12 -in root.p12 -out root.pem -passin pass:removed -passout pass:removed Error opening input file root.p12 root.p12: No such file or directory + openssl x509 -inform PEM -outform DER -in root.pem -out root.der Error opening Certificate root.pem 3925:error:02001002:system library:fopen:No such file or directory:bss_file.c:352:fopen('root.pem','r') 3925:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:354: unable to load certificate I saw a mailing list posting that said to move the CA.all script and the xpextensions file to the /etc/raddb/certs directory and run it from there, however after doing that I still receive the same errors. Anybody have any ideas on this? After googling awhile, it seems like this might be an openssl syntax error w/in the script. Also, I am using FreeRADIUS 1.1.3 (CentOS rpm install). Thanks, Walter

2 6

*** glibc detected *** radiusd: double free or corruption
by yangcuilin 01 Nov '07

01 Nov '07

Hi, all Following is error message when install freeradius1.1.3. Who can give me some advice or solutions? Appreciate very much. read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib *** glibc detected *** radiusd: double free or corruption (fasttop): 0x09b27648 *** ======= Backtrace: ========= /lib/libc.so.6[0x3c1f7d] /lib/libc.so.6(cfree+0x90)[0x3c55d0] /usr/local/lib/libltdl.so.3[0x2e451b] /usr/local/lib/libltdl.so.3(lt_dlopenext+0xbe)[0x2e4eae] radiusd(find_module_instance+0x317)[0x349c67] radiusd(setup_modules+0x1e8)[0x34a108]

3 3

FreeRadius and Clean Access Manager
by Dorota Kupis 01 Nov '07

01 Nov '07

Hello, Has anybody set up FreeRadius with Network Admission Control. I have a trouble to set up FreeRadius as an authentication server in Clean Access Manager. It works perfectly with ACS. Thanks for a help Dorota

4 6