April 2007 - Freeradius-Users - lists.freeradius.org

RES: Re: PEAP/EAP-TLS with client and server certificate
by Marcelo Augusto Rodrigues Pimentel 24 Apr '07

24 Apr '07

> I?m trying to configure freeradius with PEAP + EAP-TLS, but > I?m making some confusion to configure the radiusd.conf (sections > authorize and authentication) and eap.conf. > > Have someone implemented this configuration? > > Yes. Many people. > > In the eap.conf file the default eap type is TLS or PEAP? > > If you're doing PEAP, then it should be peap. > > What I?ve to configure in the authorize and authentication > sections? > > For basic peap, not much. Just configure "eap.conf". OK. But I´m trying to use peap to make an encrypted tunnel validating the server certificate and then I want to authenticate the clients whith EAP-TLS using client/server certificate. The TLS tunnel is working fine, but the second part of EAP-TLS authentication not. So .... in the peap section in the eap.conf, what I´ve to configure for default eap type? Is tls ? If I configure tls, I´ve to create a tls section in the peap section or the tls section of the eap.conf is enough. I´ve attached my eap.conf file. Thank´s !! eap.conf eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no # Supported EAP-types # EAP-TLS tls { private_key_password = xxxxxxxxxxxxxxxxx private_key_file = ${raddbdir}/certs/freeradius_key.pem certificate_file = ${raddbdir}/certs/freeradius_cert.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes } peap { default_eap_type = tls } #tls { #private_key_password = xxxxxxxxxxxxxxxxxxxxx #private_key_file = ${raddbdir}/certs/freeradius_key.pem #certificate_file = ${raddbdir}/certs/freeradius_cert.pem #CA_file = ${raddbdir}/certs/demoCA/cacert.pem #dh_file = ${raddbdir}/certs/dh #random_file = ${raddbdir}/certs/random #fragment_size = 1024 #include_length = yes #} #mschapv2 { #} } > *FreeRADIUS Version 1.0.1* > > Why not run 1.1.6, which has many more bug fixes and features? > > Alan DeKok. >-- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog "Mensagem protegida por sigilo profissional. Sua utilização indevida sujeita o infrator às penas da lei. Não sendo seu destinatário, por favor, elimine-a e informe o equívoco ao emitente." "This e-mail message and any attachment are intended exclusively for the named addressee. They may contain confidential information which may also be protected by professional secrecy. Unless you are the named addressee (or authorised to receive for the addressee) you may not copy or use this message or any attachment or disclose the contents to anyone else. If this e-mail was sent to you by mistake please notify the sender immediately and delete this e-mail."

2 1

rlm_eap_tls: SSL_read failed in a system call
by Sean McNamara 24 Apr '07

24 Apr '07

Hello all, I saw there was a bit of talk in 2006 over this issue, but, I wasn't able to track down a definitive solution. We're running FreeRADIUS 1.1.5 with EAP/TTLS (openSSL 0.9.8d) on Solaris 10. The server will come up and process clients for a few days, but, every now and then it begins denying all auth-requests with the following error: Apr 24 09:56:12 as2.villanova.edu radiusd[1033]: [ID 702911 daemon.notice] Login incorrect (rlm_ldap: User not found): [anonymous] (from client VillanovaWireless port 5191 cli 000b.7d22.b3a9) Apr 24 09:56:12 as2.villanova.edu radiusd[1033]: [ID 702911 daemon.error] TLS Alert write:fatal:bad record mac Apr 24 09:56:12 as2.villanova.edu radiusd[1033]: [ID 702911 daemon.error] TLS_accept:error in SSLv3 read certificate verify A Apr 24 09:56:12 as2.villanova.edu radiusd[1033]: [ID 702911 daemon.error] rlm_eap: SSL error error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac Apr 24 09:56:12 as2.villanova.edu radiusd[1033]: [ID 702911 daemon.error] rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. A restart makes the server happy and it goes back to properly auth'ing clients... As of the moment I'm compiling FreeRADIUS 1.1.6 and hoping for some improvement, but, does anyone have any additional advice or experience with this issue. .. or better yet, does anyone know the fix? Thanks for your time! ..Sean.

1 0

override ldap reply attribute
by tschaos＠gmx.net 24 Apr '07

24 Apr '07

Hi Guys, I have maybe a quite simple question: is there any way to override the default ldap-reply attribute with an other value than there is in ldap. i.e.: users-file: Default Called-Station-Id = "00-1A-30-2F-11-50:Test", Airespace-Interface-Name := 777 ldap.attrmap: replyItem Airespace-Interface-Name radiusCallingStationId wanted result: if the users-file doesnt match, use vlaue of ldap-attribute: radiusCallingStationId, otherwise use vlaue: 777 in this type of configuration it seems i cant override the ldap-reply attribute-value with the users-file. is there any possible way to do this? thanks in advance :-) freeradiusver: 1.1.4 -- "Feel free" - 10 GB Mailbox, 100 FreeSMS/Monat ... Jetzt GMX TopMail testen: http://www.gmx.net/de/go/topmail

3 6

Autotools related problems in freeradius 1.1.6
by Kostas Zorbadelos 24 Apr '07

24 Apr '07

Greetings to all in the list. I'd like to report an issue in the build scripts of freeradius. I tried to build version 1.1.6 but the problem exists in earlier versions too. If I do ./configure --prefix=/opt/freeradius the build scripts presume that --enable-developer is true. This has the effect that -DNDEBUG is not defined in CFLAGS during compilation, among other things, so the rad_assert() function can abort freeradius operation in production environments. I believe that by default, --enable-developer should be false unless explicitly set during configure. Moreover, in a Solaris 9 environment --enable-developer or --disable-developer seem to be ignored and someone should define CFLAGS explicitly in the configure command to define -NDEBUG macro. Let me know if you need anything else to trace the issue. Thanks, Kostas Zorbadelos

2 4

NAS not accepting the Access-Accept?
by Matt Ashfield 24 Apr '07

24 Apr '07

HI, I have a network switch that I'm trying to configure to allow Console port authentication via RADIUS. In the documentation of the switch it says: "To provide each user with appropriate levels of access to the switch, set the following username attributes on your RADIUS server: - R/W access -- Set the Service-Type field value to Administrative - Read-Only -- set the Service-Type field value to NAS-Prompt" So, in my users file, I have defined a user: "testuser" NAS-IP-Address == "172.16.8.30", Cleartext-Password := "testing", Service-Type =="Administrative-User" When I run in debug mode, I get the following in my log, which implies to me that the user is successfully authorized and the Access-Accept message is being sent back. Mon Apr 23 14:38:15 2007 : Debug: rlm_pap: login attempt with password testing Mon Apr 23 14:38:15 2007 : Debug: rlm_pap: Using clear text password "testing". Mon Apr 23 14:38:15 2007 : Debug: rlm_pap: User authenticated succesfully Mon Apr 23 14:38:15 2007 : Debug: modsingle[authenticate]: returned from pap (rlm_pap) for request 0 Mon Apr 23 14:38:15 2007 : Debug: modcall[authenticate]: module "pap" returns ok for request 0 Mon Apr 23 14:38:15 2007 : Debug: modcall: leaving group PAP (returns ok) for request 0 Sending Access-Accept of id 16 to 172.16.8.30 port 2048 However, when I run a packet capture, I see that no Radius attributes are being passed back to the NAS device. Shouldn't I be seeing the Administrative-User attribute? Thanks Matt mda(a)unb.ca

4 4

EAP-TLS: getting updated CRLs via cron for use with check_crl = yes option for EAP-TLS client-authN
by Reimer Karlsen-Masur, DFN-CERT 24 Apr '07

24 Apr '07

Hi, here is a pointer to a useful script I use to fetch updated CRLs for client-certificate issuing CAs from their http CDPs via cron. http://dist.eugridpma.info/distribution/util/fetch-crl/ Just add a restart for the radiusd to make it aware of new CRLs. -- Kind Regards Reimer Karlsen-Masur DFN-PKI FAQ: https://www.pki.dfn.de/faqpki -- Dipl.-Inform. Reimer Karlsen-Masur (PKI Team), Phone +49 40 808077-615 DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-555 Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737

1 0

FR + ADS 2003 + ntlm_auth
by Jacob Jarick 24 Apr '07

24 Apr '07

radius -X -f: http://pastebin.ca/455389 config files: Hello All, I have gone back to ntlm_auth for the time being instead of ldap due to the incredibly frustrating lack of good documentation (if there are good docs, link it or shutup). None of the howtos/ tutorials I have followed end in success its always some ldap error of some kind. At least 1/2 the FR + LDAP howtos say to set DEFAULT Auth-Type := LDAP which I have been told by Alan is incorrect. I followed Alans Active Directory Intergation tutorial and everything is setup as the guide says, But eap fails with this message: " rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. " I had this the 1st time I followed the pdf but I did find another howto that said to add something else and that got it working, but for the life of me I cant find it again.

3 5

rlm_ldap: Attribute "User-Password" is required for authentication. HELP Please
by Jacob Jarick 24 Apr '07

24 Apr '07

My problem is the ldap password retrieved from the windows client is not being sent to the ldap server. So I get that error when trying to login. I have added checkItem userPassword User-Password but it still complains of the same error. The weird thing is It was working fine friday.

2 8

PEAP/EAP-TLS with client and server certificate
by Marcelo Augusto Rodrigues Pimentel 24 Apr '07

24 Apr '07

Hi, I´m trying to configure freeradius with PEAP + EAP-TLS, but I´m making some confusion to configure the radiusd.conf (sections authorize and authentication) and eap.conf. Have someone implemented this configuration? In the eap.conf file the default eap type is TLS or PEAP? What I´ve to configure in the authorize and authentication sections? I´ve attached my conf files below. Best Regards ... FreeRADIUS Version 1.0.1 eap.conf eap { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no # Supported EAP-types # EAP-TLS tls { private_key_password = xxxxxxxxxxx private_key_file = ${raddbdir}/certs/freeradius_key.pem certificate_file = ${raddbdir}/certs/freeradius_cert.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes } peap { default_eap_type = tls } #tls { #private_key_password = xxxxxxxxxx #private_key_file = ${raddbdir}/certs/freeradius_key.pem #certificate_file = ${raddbdir}/certs/freeradius_cert.pem #CA_file = ${raddbdir}/certs/demoCA/cacert.pem #dh_file = ${raddbdir}/certs/dh #random_file = ${raddbdir}/certs/random #fragment_size = 1024 #include_length = yes #} #mschapv2 { #} } radiusd.conf (only authorize and authentication sections) . . . # Instantiation instantiate { } # authorize { preprocess files mschap eap } # Authentication. authenticate { Auth-Type MS-CHAP { mschap } eap } . . . "Mensagem protegida por sigilo profissional. Sua utilização indevida sujeita o infrator às penas da lei. Não sendo seu destinatário, por favor, elimine-a e informe o equívoco ao emitente." "This e-mail message and any attachment are intended exclusively for the named addressee. They may contain confidential information which may also be protected by professional secrecy. Unless you are the named addressee (or authorised to receive for the addressee) you may not copy or use this message or any attachment or disclose the contents to anyone else. If this e-mail was sent to you by mistake please notify the sender immediately and delete this e-mail."

2 1

Add a secondary ldap server to radiusd.conf
by Hubert Kupper 24 Apr '07

24 Apr '07

Hello, how can I add a secondary ldap server to radiusd.conf for failover? Regards Boert

3 5