March 2007 - Freeradius-Users - lists.freeradius.org

Re : freeradius unistalling
by Eshun Benjamin 25 Mar '07

25 Mar '07

make clean ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : elmalhi abdelghani <eabdelghani(a)yahoo.fr> À : freeradius-users(a)lists.freeradius.org Envoyé le : Vendredi, 23 Mars 2007, 14h02mn 10s Objet : freeradius unistalling Hi, how i can uninstall freeradius, i dont found make uninstall thank´s Abdelghani ELMALHI Devesestr. 1 45897 Gelsenkirchen Deutschland Tel. 00 49 176 65 84 38 50 Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses.- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

4 3

some doubts, im newbie, radius authentication and mysql.
by alex 25 Mar '07

25 Mar '07

Hey guys, we setup freeradius with mysql and radius manager 2. After the installation the mysql integration looks good. We add users and everything looks ok in the case of wireless users, they provide the mac address and here is where we have some doubts. If we add a user i can see that radius manager does not add records to some tables, that appear in some queries in the sql.conf i mean SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '00:09:5b:65:98:b0' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id I checked that tables and are empty. Only the first query looks to have a valid result. SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '00:09:5b:65:98:b0' ORDER BY id After that the other queries doesnt have a valid answer, so the user uis rejected. My question is, in the sql.conf, if i comment the queries that are searching in the empty tables, could fix the problem? or the problem is in the radius manager 2, when it add a user and is not adding to the other tables? Thanks in advance! Alex users: Matched entry DEFAULT at line 65 radius_xlat: '/usr/local/bin/mtauth.pl 00:09:5b:65:98:b0 00-09-5b-65-98-b0' modcall[authorize]: module "files" returns ok for request 205 radius_xlat: '00:09:5b:65:98:b0' rlm_sql (sql): sql_set_user escaped user --> '00:09:5b:65:98:b0' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '00:09:5b:65:98:b0' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '00:09:5b:65:98:b0' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '00:09:5b:65:98:b0' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '00:09:5b:65:98:b0' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 205 modcall: leaving group authorize (returns ok) for request 205 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user.

2 1

radexample (Postgres authenticaation)
by Ibrar Ahmed 24 Mar '07

24 Mar '07

Hi, I am a newbie in radius installation/configuration. I want to setup my radius client / server so I can authenticate/authorize a user name/password from postgresql database in plain text. For client I am using radexample.c file.. --ibrar ____________________________________________________________________________________ Finding fabulous fares is fun. Let Yahoo! FareChase search your favorite travel sites to find flight and hotel bargains. http://farechase.yahoo.com/promo-generic-14795097

1 1

CRL List does not appear to work with Freeradius
by Matt Harlum 24 Mar '07

24 Mar '07

Hey guys, I've been using freeradius for a while now, and i want to be able to revoke my certs, however when i have revoked them it can't find the CRL and as such nobody can log in - even people who have certs that are not revoked. i just get the following message, even thugh my crl.pem is in the folder with the other certs, rlm_eap_tls: <<< TLS 1.0 Handshake [length 0896], Certificate --> verify error:num=3:unable to get certificate CRL rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned

1 0

CRL Signature failure
by Jeremy Pastin 23 Mar '07

23 Mar '07

Sorry forgot a subject I am trying to set up EAP-TLS using FreeRadius, and I am using EJBCA to sign my certs. I have been able to get everything to work correctly except the CRL. I have created a directory /usr/local/etc/raddb/certs/crls where I am storing my CRL info. In this directory I have the certificate chain of the signing CA (in pem format) and the latest CRL for that CA (also in pem format). After the CRL is copied into this directory I execute c_rehash on the directory and everything runs fine. When I run radiusd, however, all attempts to authenticate are denied. The pertinent portion of the output from radiusd -X -A is : rlm_eap_tls: <<< TLS 1.0 Handshake [length 07b8], Certificate --> verify error:num=8:CRL signature failure rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert write:fatal:decrypt error TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. This seems to tell me that FreeRadius cannot verify the CRL against the CA cert. However, when I run: openssl crl -in my-crl.pem -inform PEM -CAfile my-cacert.pem -issuer -lastupdate -nextupdate -noout it returns verify OK and the correct info on issuer and update times. Also when I run: openssl verify -CApath ./ -crl_check test.pem it behaves as expected. Any Ideas? Jeremy Pastin helpdesk(a)firstindustrial.com 312-344-4444 First Industrial Realty Trust, Inc. 311 S Wacker Dr Chicago, IL 60606 Phone: 312-344-4425 Fax: 312-895-9425

1 0

(no subject)
by Jeremy Pastin 23 Mar '07

23 Mar '07

I am trying to set up EAP-TLS using FreeRadius, and I am using EJBCA to sign my certs. I have been able to get everything to work correctly except the CRL. I have created a directory /usr/local/etc/raddb/certs/crls where I am storing my CRL info. In this directory I have the certificate chain of the signing CA (in pem format) and the latest CRL for that CA (also in pem format). After the CRL is copied into this directory I execute c_rehash on the directory and everything runs fine. When I run radiusd, however, all attempts to authenticate are denied. The pertinent portion of the output from radiusd -X -A is : rlm_eap_tls: <<< TLS 1.0 Handshake [length 07b8], Certificate --> verify error:num=8:CRL signature failure rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert write:fatal:decrypt error TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. This seems to tell me that FreeRadius cannot verify the CRL against the CA cert. However, when I run: openssl crl -in my-crl.pem -inform PEM -CAfile my-cacert.pem -issuer -lastupdate -nextupdate -noout it returns verify OK and the correct info on issuer and update times. Also when I run: openssl verify -CApath ./ -crl_check test.pem it behaves as expected. Any Ideas? Jeremy Pastin helpdesk(a)firstindustrial.com 312-344-4444 First Industrial Realty Trust, Inc. 311 S Wacker Dr Chicago, IL 60606 Phone: 312-344-4425 Fax: 312-895-9425

1 0

What is the real meaning and use of cache-size in ippool declaration [resend]
by Florin 23 Mar '07

23 Mar '07

Sorry guys, this is in fact a resend of a previous email, now using Thunderbird in an attempt to avoid sending HTML format message. Hope it'll be OK this time. ~~~~~~~~~~~~~~ Hi everyone, FreeRadius 1.0.1 here, the one which comes as standard with RHEL 4. I want to use a whole class B subnet (172.16.0.0/16) in an ippool declaration to assign IP addresses from. Now it is said that the cache-size parameter should be equal to the number of IP addresses in the pool. But if I try to set it to 65536, the server won't start (it'll crash actually). So what is the **real** meaning and use of this parameter ? You have to specify the start and end of the pool, so then why set another parameter with a value that can be trivially calculated by the server anyway ? And more importantly, what are the right guidlines on setting the value for this parameter ? Making it equal to the number of IP addresses in the pool won't work and it just doesn't make any sense to me. Finally, if I change the value of this parameter, beside restarting FreeRadius, do I have to do anything else ? Do I have to delete the related database and index files in order for the change to take place ? Thank you in advance. Best regards, Florin

1 0

RE: Re: New Server Build
by Scott Hughes 23 Mar '07

23 Mar '07

Alan, Found the problem. The database was saving the password in some kind of hash instead of clear-text. Once I manually changed the password to clear-text, it I got an Auth-Accept response from the server. Now onto the EAP-TTLS & client configurations. Thanks again Alan. Scott >------- Original Message ------- >From : Alan DeKok[mailto:aland@deployingradius.com] >Sent : 3/23/2007 1:39:03 AM >To : scott(a)renshawauto.com; freeradius-users(a)lists.freeradius.org >Cc : >Subject : RE: Re: New Server Build > >Scott Hughes wrote: .. > The DB structure is: 8 tables as follows: nas, > radacct, radcheck, radgroupcheck, radgroupreply, > radpostauth, radreply, usergroup. Yes... but what's *in* the DB? What attributes, operators, and values are there, that you expect to match? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0

RE: Re: New Server Build
by Scott Hughes 23 Mar '07

23 Mar '07

Alan, The only thing in the database is the userid and password. I put nothing else in. I believe it has to do with my Default Auth-Type setting in the Users file. Thank you, Scott >------- Original Message ------- >From : Alan DeKok[mailto:aland@deployingradius.com] >Sent : 3/23/2007 1:39:03 AM >To : scott(a)renshawauto.com; freeradius-users(a)lists.freeradius.org >Cc : >Subject : RE: Re: New Server Build > >Scott Hughes wrote: .. > The DB structure is: 8 tables as follows: nas, > radacct, radcheck, radgroupcheck, radgroupreply, > radpostauth, radreply, usergroup. Yes... but what's *in* the DB? What attributes, operators, and values are there, that you expect to match? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog

1 0

Res: Res: Res: EAP-TTLS + Post-auth clear password
by Erico Augusto 23 Mar '07

23 Mar '07

----- Mensagem original ---- De: Alan DeKok <aland(a)deployingradius.com> Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Enviadas: Sexta-feira, 23 de Março de 2007 3:54:41 Assunto: Re: Res: Res: EAP-TTLS + Post-auth clear password Erico Augusto wrote: > All I can say is "huh"? You want to use a custom app, and you >solution is to write a shell script that does... nothing? sure not! > Perhaps you could explain how the custom app *currently* interacts > with FreeRADIUS. From the examples you've posted, it doesn't. it's called learning ... > My suggestion was to write a program that would send the username && > password to the custom app. See the documentation for how to see the >username && password in a shell script run by rlm_exec. that's what I'm looking for ... constructive suggestions ... > What makes you think that the shell script changes the password? >Nothing in the documentation or examples would lead you to believe that >simple echoing a number would have the magic side-effect of changing the >password. just learning how the tool works... > The configurations you've shown don't match the documentation. i.e. >You think they do one thing, but the documentation says they do >something else. The interaction with JRadius now works ... it wasn't an issue with freeradius ... JRadius API was outputing [Encrypted String] to the password ... in truth, it's just in ASCII ... a simple casting fix everything. So, to get cleartext password with WinXP SecureW2(EAP-TTLS) Supplicant configured to PAP at Authentication Tab, using JRadius API, just gather password bytes as following: byte [] passByte = requestPacket.getAttributes().get(Attr_UserPassword.NAME). getValue().getBytes(); where requestPacket is a RadiusPacket object. Erico. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Fale com seus amigos de graça com o novo Yahoo! Messenger http://br.messenger.yahoo.com/

1 0