April 2007 - Freeradius-Users - lists.freeradius.org

RE: FR 1.1.6 EAP - TLS rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal bad_certificate
by Remy de Ruysscher 29 Apr '07

29 Apr '07

Hi David, Thanks for your help! I use the port version of FR and also use portupgrade. The FreeBSD base OpenSSL is indeed rather old, so I did have OpenSSL (With_overwrite_Base) already installed from the ports. I found something wrong with the server certificates (very strange, because nothing has been altered). I don't know what this means (yet). I'm rebuilding my OpenSSL port with make clean && make reinstall and have removed all files in /usr/local/etc/raddb. So FR the port will install a clean version. Then I will compare files manually and see what changes there have been. --- defiant.unix.asp.com.pem: /C=NL/ST=Utrecht/L=Utrecht/O=UNIX-ASP.COM/OU=Support/CN=unix-asp.com/emailAd dress=support(a)unix-asp.com error 18 at 0 depth lookup:self signed certificate /C=NL/ST=Utrecht/L=Utrecht/O=UNIX-ASP.COM/OU=Support/CN=unix-asp.com/emailAd dress=support(a)unix-asp.com error 7 at 0 depth lookup:certificate signature failure 25385:error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01:/usr/src/secure/lib/libcrypto/../../../crypto/openssl/crypto/rsa/rsa_pk1. c:100: 25385:error:04067072:rsa routines:RSA_EAY_PUBLIC_DECRYPT:padding check failed:/usr/src/secure/lib/libcrypto/../../../crypto/openssl/crypto/rsa/rsa_ eay.c:625: 25385:error:0D089006:asn1 encoding routines:ASN1_verify:EVP lib:/usr/src/secure/lib/libcrypto/../../../crypto/openssl/crypto/asn1/a_veri fy.c:162: Regards, Remy. -----Original Message----- From: freeradius-users-bounces+remy=unix-asp.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+remy=unix-asp.com@lists.freeradius.org] On Behalf Of David Wood Sent: zondag 29 april 2007 0:38 To: FreeRadius users mailing list Subject: Re: FR 1.1.6 EAP - TLS rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal bad_certificate Hi Remy and everyone, In message <200704281849.l3SInfTu086460(a)mxdrop40.xs4all.nl>, Remy de Ruysscher <remy(a)unix-asp.com> writes >I just upgrade FR 1.1.4 to 1.1.6 on FreeBSD 6.1. And FR has always >worked wonderfully for me in the past. I'm the maintainer of the FreeBSD port. My 6.2-RELEASE-p2 i386 system uses EAP-TLS - and it works fine, so it is probably something with your setup. I'm assuming you're using the port - though you didn't say so specifically. I use the OpenSSL port - and suggest you do too, as the version of OpenSSL in the base system is rather old. If you've got the OpenSSL port installed, the FreeRADIUS port will notice and make use of it automatically. The package, meanwhile, uses the base OpenSSL. If you install the OpenSSL port, you'll need to rebuild the FreeRADIUS port for FreeRADIUS to use it. If you have portupgrade installed, and want to switch to using the OpenSSL port, try: portupgrade -N security/openssl portupgrade -f net/freeradius /usr/local/etc/rc.d/radius start I suggest you also rebuild any other ports that use OpenSSL if you've installed the OpenSSL port for the first time. Use portupgrade -f or similar. Of course, it could be that your server certificate is actually bad. Do the results of: openssl verify -CAfile demoCA/cacert.pem -verbose cert-srv.pem and openssl x509 -in cert-srv.pem -noout -text look OK? You may need to adjust the filenames according to your environment - I'm presuming that you're in your raddb certificates folder. If you have the OpenSSL port installed, I suggest you explicitly use /usr/local/bin/openssl instead of openssl in the commands above. The handling of raddb upgrading has changed significantly from version 1.1.4 of the port to 1.1.6. It's just possible that your certificates have got stomped on if they are in /usr/local/etc/raddb/certs (adjusted accordingly if you have a non-standard ${PREFIX}), but I can't think why, as the script is fairly careful in checking before overwriting anything in raddb. That said, the new behaviour on uninstallation is to check any files in raddb against the distribution, and delete unmodified files. On installation, it copies the distribution files to raddb unless there's already a file of the same name. It's possible that your upgrade to 1.1.6 has created mixed versions (new uncustomised files and your customisations based on a rather older version of FreeRADIUS) - and that's introduced a problem, though I feel this is unlikely. My favourite is either there's something wrong with your server certificate, or it's a problem with the base system OpenSSL that you can cure by moving to the OpenSSL port. I'd be interested to know how you get on, particularly if the problem turns out to be something different. If you want a tarball of the 1.1.4 port, email me - I can pull out the last version of 1.1.4 from my local Subversion repository before I upgraded the port to 1.1.5. There were a lot of fixes in the 1.1.4 timeframe - there was a 1.1.4 port on 15 January 2007, 1.1.4_1 on 18 January 2007, and a rewrap of 1.1.4_1 on 23 January 2007. The 15 January -> 18 January transition merely disabled rlm_sql_firebird (otherwise the port failed to build with experimental modules disabled). The 18 January -> 23 January 2007 update contained a bunch of fixes, including the first version of the revised raddb handling (the very first time that the port touched files other than those suffixed .sample in raddb). http://www.freshports.org/net/freeradius/ will walk you through the changes in more detail, though my local Subversion repository is more finely grained. There were two further changes before I upgraded to 1.1.5 - support for the freeradius-mysql slave port, and a change to the current version of raddb handling. However, I hope we can get the 1.1.6 port working on your machine, and I don't have to unravel the many changes made from the last version of 1.1.4_1 through 1.1.5 to 1.1.6. Best wishes, David -- David Wood david(a)wood2.org.uk - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

FR 1.1.6 EAP - TLS rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal bad_certificate
by Remy de Ruysscher 28 Apr '07

28 Apr '07

Hi, I just upgrade FR 1.1.4 to 1.1.6 on FreeBSD 6.1. And FR has always worked wonderfully for me in the past. I saw in the changelog something about terminating the SSL session in EAP on errors. What can I do to fix this error? Regards, Remy. --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.250:3072, id=1, length=256 User-Name = "monique(a)unix-asp.com" NAS-IP-Address = 10.0.1.250 Called-Station-Id = "0012176fb399" Calling-Station-Id = "0013022105d3" NAS-Identifier = "0012176fb399" NAS-Port = 55 Framed-MTU = 1400 State = 0x99e6bf386c1693ffe99cc51011c78c22 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201006e0d8000000064160301005f0100005b030146338b7df93bc3ecee992b73b782861f b83b032ad4e5d0e367a50e96a5f4d07e00003400390038003500160013000a00330032002f00 6600050004006500640063006200610060001500120009001400110008000600030100 Message-Authenticator = 0xd1dcd23d54281665000ddf314423cf61 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 radius_xlat: '/var/log/radacct/10.0.1.250/auth-detail-20070428' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/10.0.1.250/auth-detail-20070428 modcall[authorize]: module "auth_log" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: Looking up realm "unix-asp.com" for User-Name = "monique(a)unix-asp.com" rlm_realm: No such realm "unix-asp.com" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 110 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 005f], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 02ca], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00a9], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 1 to 10.0.1.250 port 3072 EAP-Message = 0x010203d60d80000003cc160301004a02000046030146338b7ad2b5446adeec2e4c5dbeebbf 060ca75333f41f2cd07136ceb4f1e16020c03cc6c37f378e3a121feb1d2b2ff0720a72311530 9f56d0f8db9efb1334024f00350016030102ca0b0002c60002c30002c0308202bc30820225a0 0302010202020122300d06092a864886f70d0101050500308196310b3009060355040613024e 4c3110300e06035504081307557472656368743110300e060355040713075574726563687431 153013060355040a130c554e49582d4153502e434f4d3110300e060355040b1307537570706f 7274311530130603550403130c756e69782d6173702e636f6d31 EAP-Message = 0x23302106092a864886f70d0109011614737570706f727440756e69782d6173702e636f6d30 1e170d3037303432383137343331325a170d3038303432373137343331325a308196310b3009 060355040613024e4c3110300e06035504081307557472656368743110300e06035504071307 5574726563687431153013060355040a130c554e49582d4153502e434f4d3110300e06035504 0b1307537570706f7274311530130603550403130c756e69782d6173702e636f6d3123302106 092a864886f70d0109011614737570706f727440756e69782d6173702e636f6d30819f300d06 092a864886f70d010101050003818d0030818902818100c4d9ff EAP-Message = 0x25696b959b20ce440ea32876f9083badb184a2a86c2269205ca4442c6c386546face2e2ec0 5b6a0af3d11094e0fe389198023ee39fafb456de6832483e99c29231034840334c91ccafeb80 f7bd019f3493977c03b7e8ed7824395ec401a2f5eb1540db144670038cc6ca8308c982ac3038 1da8228a479740e4049ef8870203010001a317301530130603551d25040c300a06082b060105 05070301300d06092a864886f70d010105050003818100741dcc0890f8e7cb9651648a76005c 9382030b41b9ac3d6d09fe32f7e0dedaa25c34e6a970a4c92666c3dc1a96096b824871a31b43 15d065bdcad0f8bf8d77a6e00afd76bf9c924b91741c36142c49 EAP-Message = 0x1c9aa8bd1665c0bda3edc5e3b9dd9c95c3d5d304204d55c2876cf0265837fd68c9c92a181a c73e0e208975d3bffa7a37c016030100a90d0000a103010240009b0099308196310b30090603 55040613024e4c3110300e06035504081307557472656368743110300e060355040713075574 726563687431153013060355040a130c554e49582d4153502e434f4d3110300e060355040b13 07537570706f7274311530130603550403130c756e69782d6173702e636f6d3123302106092a 864886f70d0109011614737570706f727440756e69782d6173702e636f6d0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcb376b4b0ff5456ba9300ec08c5b69aa Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.250:3072, id=1, length=163 User-Name = "monique(a)unix-asp.com" NAS-IP-Address = 10.0.1.250 Called-Station-Id = "0012176fb399" Calling-Station-Id = "0013022105d3" NAS-Identifier = "0012176fb399" NAS-Port = 55 Framed-MTU = 1400 State = 0xcb376b4b0ff5456ba9300ec08c5b69aa NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200110d80000000071503010002022a Message-Authenticator = 0x73d8ae0eec89244e63a52fa4e5fc8e7f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 radius_xlat: '/var/log/radacct/10.0.1.250/auth-detail-20070428' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/10.0.1.250/auth-detail-20070428 modcall[authorize]: module "auth_log" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: Looking up realm "unix-asp.com" for User-Name = "monique(a)unix-asp.com" rlm_realm: No such realm "unix-asp.com" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal bad_certificate TLS Alert read:fatal:bad certificate TLS_accept:failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 2 modcall: leaving group authenticate (returns reject) for request 2 auth: Failed to validate the user. Delaying request 2 for 1 seconds Finished request 2 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Sending Access-Reject of id 1 to 10.0.1.250 port 3072 EAP-Message = 0x04020004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 2 ID 1 with timestamp 46338b7a Nothing to do. Sleeping until we see a request.

2 1

cert Trust settings on MAC client
by Eshun Benjamin 28 Apr '07

28 Apr '07

Any one has an idea of getting rid of "The server certificate is not trusted because there are no explicit trust settings" on MAC OSX 10.4.9 without selecting "always trust this certificate" ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Vendredi, 27 Avril 2007, 17h47mn 46s Objet : Re: Performance with Freeradius-1.1.4 nikitha george wrote: > I am using freeradius-1.1.4 with PEAP-MSCHAPV2. Each session starting > from Access-Request till Access-Accept it takes more than 250ms to > complete. Is it the normal performance of freeradius-1.1.4 or anything > suspicious in this regard? It depends on your CPU speed, etc. But it's not out of line. Almost all of that time is spent in OpenSSL, doing cryptography. > When i try to send many Request > simultaneously then there is no response from the server for the latest > requests as the server is busy processing first request. > Only the first request gets response after 250ms. Are you sure you're not running the server in single threaded mode? Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

1 0

Re: Win XP with 802.1x PEAP (EAP-MSCHAP V2)
by Marc Charbonneau 28 Apr '07

28 Apr '07

This incorrect password issue was solved once the proper server certificate was used by FreeRADIUS' EAP.conf file. Thanks for all you help! Marc Solution to get correct cert to work with Windows XP SP2 supplicant: 1) From Linux box: >openssl genrsa -des3 -out server1.key 2048 You will be prompted for password, this server1.key and the password assigned are used in "eap.conf" file. >openssl req -new -key server1.key -out server1.csr 2) Get "server1.csr" to a Windows workstation that will reach the Microsoft 2003 CA. Easiest way might be to use FTP. The URL to our CA is: http://10.10.10.10/certsrv 3) On Web access to CA: - click "Request a Certificate" - click "Advanced certificate request" - click "Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file." - click "Browse for a file to insert." and browse to "ohisles1.csr" then click "READ" button. - select "Web Server" for certificate template and click "Submit" - keep "DER encoded" selected then click "Download certificate", save file as server1.cer 4) Get this file "server1.cer" back to Linux server with FTP 5) Issue OpenSSL command >openssl x509 -inform DER -in ohisles1.cer -out ohisles1.pem - update "eap.conf" to point to this server certificate. 6) Use same OPENSSL command on the CER file of the root certificate from the Microsoft CA to convert it to PEM format. Use this root certificate, we named it "root.pem" and point to it in the "eap.conf" 7) FreeRADISU with: >RADIUSD -X 8) Windows XP supplicant should work fine.

1 0

SQL for return attributes only?
by Hugh Messenger 28 Apr '07

28 Apr '07

ObDisclaimer: I have googled my best google, and read all the docs I can find, so please be gentle if this is a dumb question. Is it possible with freeradius to use SQL to retrieve certain return attributes (in this case rate limiting values for PPPOE sessions), whilst still handling authentication through PAM? In other words, I don't want to authenticate using SQL, I simply want to grab an attribute or two from a MySQL database, indexed by username, if the PAM authentication succeeds. I'm using the Winbind PAM module to authenticate against a Windows AD (a "legacy" requirement), so storing passwords in MySQL is a non-starter. -- hugh -- Hugh Messenger hugh(a)alaweb.com

2 1

1.16 segfaulting on LDAP search
by Richard Hesse 27 Apr '07

27 Apr '07

Trying to upgrade from 1.14 to 1.16 for stability gains (hopefully). Unfortunately, it's segfaulting on the first request that comes in. The LDAP libraries haven't changed and to ensure that there aren't any collisions with 1.14 installation, everything (conf, libs, binaries) are in a new location. I'd appreciate any help here. Some info when run from gdb (I have dump files, too): rad_recv: Access-Request packet from host 208.76.47.238:1083, id=14, length=203 Framed-MTU = 1480 NAS-IP-Address = 208.76.47.238 NAS-Identifier = "h2848-1" User-Name = "richard" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 3 NAS-Port-Type = Ethernet NAS-Port-Id = "3" Called-Station-Id = "00-18-71-e1-08-80" Calling-Station-Id = "00-17-f2-ce-78-b8" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "666" EAP-Message = 0x02ed000c0172696368617264 Message-Authenticator = 0xce044840910a831cb30359cd7a249b08 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 rlm_realm: No '@' in User-Name = "richard", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "richard", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'dc=domain,dc=com' radius_xlat: '(uid=richard)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to fds1.hq.domain.com fds2.hq.domain.com:389, authentication 0 Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 46912536543248 (LWP 29012)] 0x00002aaaad57a4a0 in ldap_set_option () from /usr/lib64/libldap_r-2.3.so.0 (gdb) bt #0 0x00002aaaad57a4a0 in ldap_set_option () from /usr/lib64/libldap_r-2.3.so.0 #1 0x00002aaaad346308 in ldap_connect (instance=0x55555589ec90, dn=0x55555589e360 "", password=0x55555589ee70 "", auth=0, result=0x7ffffa457b04, err=0x0) at rlm_ldap.c:1975 #2 0x00002aaaad346cc3 in perform_search (instance=0x55555589ec90, conn=0x55555589f220, search_basedn=0x7ffffa457ba0 "dc=domain,dc=com", scope=2, filter=0x7ffffa4583a0 "(uid=richard)", attrs=0x7ffffa4587b0, result=0x7ffffa4587c8) at rlm_ldap.c:774 #3 0x00002aaaad347e69 in ldap_groupcmp (instance=0x55555589ec90, req=0x5555558c8d70, request=<value optimized out>, check=<value optimized out>, check_pairs=<value optimized out>, reply_pairs=<value optimized out>) at rlm_ldap.c:943 #4 0x0000555555569f31 in paircmp () from /p/sbin/radiusd #5 0x00002aaaaeff043f in hints_setup (hints=0x5555558bfcc0, request=0x5555558c8d70) at rlm_preprocess.c:331 #6 0x00002aaaaeff05c2 in preprocess_authorize (instance=0x5555558bb640, request=0x5555558c8d70) at rlm_preprocess.c:560 #7 0x00005555555635d2 in modcall () from /p/sbin/radiusd #8 0x0000555555563b91 in modcall () from /p/sbin/radiusd #9 0x00005555555637a6 in modcall () from /p/sbin/radiusd #10 0x000055555555bafb in rad_authenticate () from /p/sbin/radiusd #11 0x0000555555564af5 in rad_respond () from /p/sbin/radiusd #12 0x00005555555660c3 in main () from /p/sbin/radiusd __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Re: Win XP with 802.1x PEAP (EAP-MSCHAP V2)
by Marc Charbonneau 27 Apr '07

27 Apr '07

Hi, it looks like I used a certificate with the wrong OID. I used a cert minted with their "SubCA" template which doesn't have the (OID 1.3.6.1.5.5.7.3.1). In "playing" with the Microsoft CA on Windows 2003 server, I've found that the Certificate made using the "Web Server" template is the one required. Unfortunately, this particular template doesn't allow the Certificate's keys to be exported. I tried creating a new Certificate template by copying from the one called "Web Server" and now, I have a new "Web Server" template with the ability to export it's keys. The problem is I can't seem to make use of this new template within their CA. I know this is a Microsoft issue but I've looked high and low in their docs and when you go to their CA and try to select "Certificate Template to Issue", the new template created are not available. I'm a little obsessed with making this work so I'm hoping someone here a quick answer to making Microsoft's CA allow me to mint a Web Server certificate with exportable keys. Thanks for any future and previous help, Marc >>> karlsen-masur(a)dfn-cert.de 4/27/2007 4:11:58 AM >>> Hi. A.L.M.Buxey(a)lboro.ac.uk wrote: > either use your current tool but include the XP extensions as required, Just to be precise. The named extensions are PKIX extensions for serverAuth (OID 1.3.6.1.5.5.7.3.1) (at the RADIUS server) and clientAuth (OID 1.3.6.1.5.5.7.3.2) (for EAP-TLS on the supplicant). Also if a client certificate is used on Windows with EAP-TLS the extendedKeyUsage "Microsoft SmartCard Logon" (OID 1.3.6.1.4.1.311.20.2.2) *must not* be present because Windows won't be able to use/choose such a client certificate to authenticate at the RADIUS server. It is only Windows that is looking at these extededKeyUsages in the certificate and expecting the correct extensions here. -- Beste Gruesse / Kind Regards Reimer Karlsen-Masur DFN-PKI FAQ: https://www.pki.dfn.de/faqpki -- Dipl.-Inform. Reimer Karlsen-Masur (PKI Team), Phone +49 40 808077-615 DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-555 Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737

1 0

VSA for3com5500
by Gerard Mansvelder 27 Apr '07

27 Apr '07

Hi, Does anyone know if freeradius has VSA's for 3com5500, and if not, Where I can get them and how I should import them. Thanks, Gerard. ( mailto:freeradius-users@lists.freeradius.org )

2 1

Compiling 1.1.6 on OSX 10.4.9 Server
by Joseph Sullivan 27 Apr '07

27 Apr '07

Hello, I have made numerous attempts to Compile Freeradius on my OSX 10.4.9 machine with no avail. I found that V-1.1.1 was included in Darwin Ports, but it gives me Library errors when I try Installing it. I see lots of posts of people trying to get FreeRadius working on a mac, some have done it, with no explanation, and some asked, posted errors, and then disappear. I have a fresh Install with all osx updates. I downloaded v-1.1.6 and unpacked it. ./configure --enable-developer --disable-shared It does its thing with no apparent errors. When I run Make, it errors with /freeradius-1.1.6/libtool --mode=link gcc -release 1.1.6 \ -module -static -o rlm_perl.la \ -rpath /usr/local/lib rlm_perl.lo rlm_perl.c /freeradius-1.1.6/src/lib/libradius.la \ `perl -MExtUtils::Embed -e ldopts` -lresolv -lpthread *** Warning: Linking the shared library rlm_perl.la against the *** static library /System/Library/Perl/5.8.6/darwin-thread-multi-2level/auto/DynaLoader/DynaLo ader.a is not portable! rm -fr .libs/rlm_perl-1.1.6.so .libs/rlm_perl.a .libs/rlm_perl.so ar cru .libs/rlm_perl.a /System/Library/Perl/5.8.6/darwin-thread-multi-2level/auto/DynaLoader/DynaLo ader.a rlm_perl.o /System/Library/Perl/5.8.6/darwin-thread-multi-2level/auto/DynaLoader/DynaLo ader.a ranlib: archive member: .libs/rlm_perl.a(DynaLoader.a) fat file for cputype (7) cpusubtype (3) is not an object file (bad magic number) ar: internal ranlib command failed make[6]: *** [rlm_perl.la] Error 1 make[5]: *** [common] Error 2 make[4]: *** [all] Error 2 make[3]: *** [common] Error 2 make[2]: *** [all] Error 2 make[1]: *** [common] Error 2 make: *** [all] Error 2 Has anyone attempted this ver with Tiger server? I can give ssh access if someone wants to poke around. Any help is appreciated Joseph Sullivan

2 2

radrelay causing duplicates
by Brian Walters 27 Apr '07

27 Apr '07

I'm trying to set up a system with 3 radius servers and want to store all accounting data on all 3 systems. This worked well in a 2 server system with radrelay running on both systems. rad1 <---> rad2 It this situation radrelay uses the Client-IP-Address attr to decide if something is a duplicate. Now in a 3 server config, I want to send the accounting packets to all 3 servers. So I set up 2 radrelay instances on each server pointing to the 2 other servers. i.e. rad1 relay-> rad2, rad1 relay-> rad3 rad1 /\ / \ / \ rad2---rad3 The problem is that when rad2 gets the packet from rad1, it then sends that packet to rad3 but now the client ip is that of rad2 not rad1 so when rad3 also sees the accounting packet from rad1 it adds the entry. I've thought about filtering this in the detail-combined files but I haven't figured out how to filter out records at that level. Suggestions welcomed -- Brian

1 0