May 2007 - Freeradius-Users - lists.freeradius.org

EAP-TLS: Different Certificates for different Called-Station-Id
by Wolfgang Burger 24 May '07

24 May '07

Hi, i´ve set up a freeRadius-Server (1.1.6) on OS X 10.3.9. I'm using it to authenticate my Wireless-LAN with 802.1X, EAP and self created certificates. Evertything works well so far. Is there any possibility to select different certificate_files and private_key_files, deppending on the Called-Station-ID of the request? As like: Called-Station-ID = "00112233445566:SSID1" -> Use Cert1.pem Called-Station-ID = "00112233445566:SSID2" -> Use Cert2.pem Thank you so much for any help. Kind Regards / Mit freundlichen Grüßen Wolfgang Burger <burgerw(a)immunbio.mpg.de> Max-Planck-Institut fuer Immunbiologie Scientific Data Processing Unit (+00 49) 761 / 5108 461 Stuebeweg 51 D-79108 Freiburg Germany

2 1

Grouping users and clients
by Giovanni Lovato 24 May '07

24 May '07

Hi all. We have a set of Cisco routers and a pool of users in an LDAP directory. At this time routers are configured to request authentication to FreeRadius, which binds to LDAP and grants access to user on successfully binding. We need to create groups of routers and groups of users, granting accesso to certain groups of routers only to certain groups of users. Can we do that using FreeRadius? Thank you, G.L. -- www.aldu.net/~heruan giovanni.lovato(a)aldu.net

5 7

postauth_query question
by Christoffer Dahl Petersen 24 May '07

24 May '07

Hi I'm trying to log authorization request to a postgres db. My postauth query: postauth_query = "INSERT INTO authlog (where, who, reply,authdate) VALUES ('%{NAS-IP-Address}','%{User-Name}','%{reply:Packet-Type}', NOW())" Could I use another attribute rather than NAS-IP-Address that would translate NAS-IP-Address into the shortname given i clients.conf? Some info: radiusd -X <snip> rad_recv: Access-Request packet from host 192.168.250.20:6001, id=12, length=69 User-Name = "00-15-00-15-23-3f" User-Password = "28652865" NAS-IP-Address = 192.168.250.20 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '00-15-00-15-23-3f' rlm_sql (sql): sql_set_user escaped user --> '00-15-00-15-23-3f' <snip> I have enabled "log_auth = yes" in radiusd.conf, and i get this in radiusd.log: Thu May 24 11:26:19 2007 : Auth: Login OK: [00-15-00-15-23-3f/00-15-00-15-23-3f] (from client radiustest port 0) I would like to log "radiustest" rather than 192.168.250.20 Christoffer

1 0

Reply-Item from LDAP groups
by Giovanni Lovato 24 May '07

24 May '07

Can I get a Reply-Item from LDAP groups? For example: dn: uid=testuser,ou=people,dc=domain,dc=tld uid: testuser ... dn: cn=testgroup,ou=groups,dc=domain,dc=tld cn: testgroup ... objectClass: radiusprofile radiusReplyItem: Cisco-AVPair := "shell:priv-lvl=5" so that every user of testgroup gets a priv-lvl of 5? Thank you, G.L. -- www.aldu.net/~heruan giovanni.lovato(a)aldu.net

2 1

log file for free radius 1.1.6 eap-tls authentication
by Anoop 24 May '07

24 May '07

Hi I am using free raidus 1.1.6 with eap-tls authentication.The whole set up is working fine. But i am not getting any logs .like user login ok..login filef etc Pls giude me How will i get logs and wat configurtion i need to do in the configuration files. Regards Anoop ********** DISCLAIMER ********** Information contained and transmitted by this E-MAIL is proprietary to Sify Limited and is intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If this is a forwarded message, the content of this E-MAIL may not have been sent with the authority of the Company. If you are not the intended recipient, an agent of the intended recipient or a person responsible for delivering the information to the named recipient, you are notified that any use, distribution, transmission, printing, copying or dissemination of this information in any way or in any manner is strictly prohibited. If you have received this communication in error, please delete this mail & notify us immediately at admin(a)sifycorp.com

2 1

Segmentation Fault while connecting users to the radius Server
by prajakta choudhari 24 May '07

24 May '07

Hi all: I have configured the radius server . I have a linksys router with wireless security as RADIUS enabled and laptop that connects to the linksys router. whenever i try connecting to the router, i get a segmentation fault. I am pasting the output ./radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/radius/etc/raddb/proxy.conf Config: including file: /usr/local/radius/etc/raddb/clients.conf Config: including file: /usr/local/radius/etc/raddb/snmp.conf Config: including file: /usr/local/radius/etc/raddb/eap.conf Config: including file: /usr/local/radius/etc/raddb/sql.conf main: prefix = "/usr/local/radius" main: localstatedir = "/usr/local/radius/var" main: logdir = "/usr/local/radius/var/log/radius" main: libdir = "/usr/local/radius/lib" main: radacctdir = "/usr/local/radius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/radius/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/radius/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/radius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/radius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/radius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/root/cer/cert-srv.pem" tls: certificate_file = "/root/cer/cert-srv.pem" tls: CA_file = "/root/cer/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/radius/etc/raddb/certs/dh" tls: random_file = "/usr/local/radius/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/radius/etc/raddb/huntgroups" preprocess: hints = "/usr/local/radius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/radius/etc/raddb/users" files: acctusersfile = "/usr/local/radius/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/radius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/radius/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.6.15:2050, id=0, length=129 User-Name = "cert-clt" NAS-IP-Address = 192.168.6.15 Called-Station-Id = "0012172a3dac" Calling-Station-Id = "0020e04d22f7" NAS-Identifier = "0012172a3dac" NAS-Port = 24 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000d01636572742d636c74 Message-Authenticator = 0xbceb70d19b2cc1c0dc9322fed00b080b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "cert-clt", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry cert-clt at line 147 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 192.168.6.15 port 2050 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc74d3df792dfa42ce1d7641977a986be Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.15:2050, id=0, length=214 User-Name = "cert-clt" NAS-IP-Address = 192.168.6.15 Called-Station-Id = "0012172a3dac" Calling-Station-Id = "0020e04d22f7" NAS-Identifier = "0012172a3dac" NAS-Port = 24 Framed-MTU = 1400 State = 0xc74d3df792dfa42ce1d7641977a986be NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020100500d800000004616030100410100003d03014655e5839870f7090875f2d03b01a78dfc08d4ff29504c0d955feed1f10d22e400001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0xb260838022a8d6cef007c044dfa525e1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "cert-clt", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 1 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry cert-clt at line 147 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0615], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0093], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 0 to 192.168.6.15 port 2050 EAP-Message = 0x0102040a0dc000000701160301004a0200004603014655358ff1959233436e77369c581d28e3c2fb848153ae6bde2d1ff533a4bc0a20ef2ef232ab36c20b2f50da0044c8a39c22c669dc1a2f0ac3d3fcca41470d5ddd00040016030106150b00061100060e00029830820294308201fda003020102020102300d06092a864886f70d0101050500308181310b300906035504061302494e311430120603550408130b4d61686172617368747261310d300b060355040a130443444143310c300a060355040a1303534d55310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d0109011611707261 EAP-Message = 0x6a616b74616340636461632e696e301e170d3037303532333131343432345a170d3038303532323131343432345a308184310b300906035504061302494e311430120603550408130b4d61686172617368747261310d300b060355040a130443444143310c300a060355040a1303534d55310d300b060355040b13044e4953473111300f06035504031308636572742d7372763120301e06092a864886f70d01090116117072616a616b74616340636461632e696e30819f300d06092a864886f70d010101050003818d0030818902818100b029e54f9c5b0446b441bbc278888d395ed5698804fc447076f2495fbfd46904b18e2a80c9343b16f49b4e EAP-Message = 0xc15dc980a1522a40f493c0f039686de2170597ef8c8ad201fa94d678e437151a18a3629e93e52f228baad4f2aa3fbf34b3401a33c596b3b060148f368802978f49b55c8ec5bc44a4cf30f35d0a5bab51e80ec4d5dd0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010105050003818100a5550a63cfb66f97d6f4d10d1cb572e0a0afd9d5efe92bb6f725651932333fc1bfa4631917ec15d92f68c73e95f09bf98f1832bd7c0766a3cac4d23aecf496c77cac9dd1ef68af34bd0621e954c914e4f6defebe16f413c348a3364cd724d4f663bc8b0797bbc3b7de39ef86d6a3f315104db7450643d6 EAP-Message = 0xaa03d794a71ff17ef80003703082036c308202d5a003020102020900d6bff812d049419a300d06092a864886f70d0101050500308181310b300906035504061302494e311430120603550408130b4d61686172617368747261310d300b060355040a130443444143310c300a060355040a1303534d55310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d01090116117072616a616b74616340636461632e696e301e170d3037303532333131343333365a170d3039303532323131343333365a308181310b300906035504061302494e311430120603550408130b4d61686172617368747261 EAP-Message = 0x310d300b060355040a130443444143310c300a060355 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x64f32e25c5aaf8ab88d7a8e3848c6bc1 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.15:2050, id=0, length=140 User-Name = "cert-clt" NAS-IP-Address = 192.168.6.15 Called-Station-Id = "0012172a3dac" Calling-Station-Id = "0020e04d22f7" NAS-Identifier = "0012172a3dac" NAS-Port = 24 Framed-MTU = 1400 State = 0x64f32e25c5aaf8ab88d7a8e3848c6bc1 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060d00 Message-Authenticator = 0x4e5b8e387844bf4783e884f01df16133 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "cert-clt", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry cert-clt at line 147 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 0 to 192.168.6.15 port 2050 EAP-Message = 0x0103030b0d8000000701040a1303534d55310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d01090116117072616a616b74616340636461632e696e30819f300d06092a864886f70d010101050003818d0030818902818100bdfe4112c5041e54060423446b4f5bee0b6bb2d4699d825e9227e60574e27526aa1177fdc5e63dbf6d341f635b681e184231abb90993e97449f584eb88cd59a3514e6cc869891e71c703cf5939fd218ec8db0f0243860e4307a853b7ab6edd4c14b04bd6091b354d7a62150dda4b42c0e9957dadb10b205b2c745d35b155891f0203010001a381e93081e6301d06 EAP-Message = 0x03551d0e0416041495b0e7c6e725388bd31920c5587965c16ec8f8e43081b60603551d230481ae3081ab801495b0e7c6e725388bd31920c5587965c16ec8f8e4a18187a48184308181310b300906035504061302494e311430120603550408130b4d61686172617368747261310d300b060355040a130443444143310c300a060355040a1303534d55310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d01090116117072616a616b74616340636461632e696e820900d6bff812d049419a300c0603551d13040530030101ff300d06092a864886f70d01010505000381810030b37815ac668d EAP-Message = 0x0f6b68bbf734eaa9de304ef85416c0c7ca567dadd2f19b9313e21f8ffb40a1276b47b928ef9c28c74b4a3cd252cef6879e941f2dd3c3822888ec259ce5d3a59a130baa0320ff513ede689b6c5cd856a428edb1f9ed622586b74819cd4b12e0fcd2c1261ddf576af64371bda1c61427c0029f291838b49e5d4d16030100930d00008b02010200860084308181310b300906035504061302494e311430120603550408130b4d61686172617368747261310d300b060355040a130443444143310c300a060355040a1303534d55310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d010901161170 EAP-Message = 0x72616a616b74616340636461632e696e0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4542b69e6b6fe472b3d3967cc1157fde Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.6.15:2050, id=0, length=1140 User-Name = "cert-clt" NAS-IP-Address = 192.168.6.15 Called-Station-Id = "0012172a3dac" Calling-Station-Id = "0020e04d22f7" NAS-Identifier = "0012172a3dac" NAS-Port = 24 Framed-MTU = 1400 State = 0x4542b69e6b6fe472b3d3967cc1157fde NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020303e80d80000003de16030103ae0b00029e00029b00029830820294308201fda003020102020101300d06092a864886f70d0101050500308181310b300906035504061302494e311430120603550408130b4d61686172617368747261310d300b060355040a130443444143310c300a060355040a1303534d55310d300b060355040b13044e495347310e300c060355040313057072616a753120301e06092a864886f70d01090116117072616a616b74616340636461632e696e301e170d3037303532333131343335375a170d3038303532323131343335375a308184310b300906035504061302494e311430120603550408130b4d6168617261 EAP-Message = 0x7368747261310d300b060355040a130443444143310c300a060355040a1303534d55310d300b060355040b13044e4953473111300f06035504031308636572742d636c743120301e06092a864886f70d01090116117072616a616b74616340636461632e696e30819f300d06092a864886f70d010101050003818d0030818902818100bca99f739541ff5508930cdac4b928611acf16bbc153a5fd10ddd735468d3f8a633566a1c059b807aacfbf5d112d1abfaa5e4834245f04cc818e20442306909c3f16b0b4ae404493281ed2509083a6465704eec6036e6566270dffea047e9207ac7681f2ca70164aa0a2a014d96a439112b3f7877cfa1297a306 EAP-Message = 0x262e3f6ced850203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d010105050003818100b87aad1c3e9ccbc82a753b013bf5f4e76328950b473b8bc42f6826b19af18a4d9a2352498d613fc64155f828a3d94999c3903a305a55f46198b6ecc49b4c3f9b80c9da6af5e052da06fd47803b95d9d9c39adeed6d5a85d7d6aa2c3a284d58e99dc977eafa40a511f27938a4618262dc5f9816eefc1b9c4173f1094ec0011a131000008200806fdfdfe127fe8fc94e04a802ef1b2927d1ec0658dda9447b538cbdea8fa1cc6bc60a0802d96f8381412c875f21bb9d95b852d746dc87187fcfad61ce609e45e4 EAP-Message = 0x7986d161dcc789f90d05c6658bebcede0478701a9087b51f6caccffa970d358176534234c00472e5a9b24815972b7237d166d01d9b31cba5ab108398ce75d6730f00008200805b3c0af06040fc3b45ec57da589accc861eb1107a14a06e6d7b4e82676ac0529d4abf0c1894acd49e93406a5bde637a1eb5645e0faae07c60ff356cbd82ccdae1d967bd71885bed3231152adcf34f9d615e0b4bd07d076ae1e8b35be79ac768b02f5808f9268141921b4508e24f6b88252b9a63cbafa02845d796cef1e353f7e140301000101160301002035cb33f611aece26c4acad92877fd3d1d7e95621cc6a3855fb20b3f527ed4e51 Message-Authenticator = 0xdb211f26cce1b1207536c932978decea Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "cert-clt", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 3 length 253 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry cert-clt at line 147 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 02a2], Certificate chain-depth=1, error=0 --> User-Name = cert-clt --> BUF-Name = praju --> subject = /C=IN/ST=Maharashtra/O=CDAC/O=SMU/OU=NISG/CN=praju/emailAddress=prajaktac(a)cdac.in --> issuer = /C=IN/ST=Maharashtra/O=CDAC/O=SMU/OU=NISG/CN=praju/emailAddress=prajaktac(a)cdac.in --> verify return:1 chain-depth=0, error=0 --> User-Name = cert-clt --> BUF-Name = cert-clt --> subject = /C=IN/ST=Maharashtra/O=CDAC/O=SMU/OU=NISG/CN=cert-clt/emailAddress=prajaktac(a)cdac.in --> issuer = /C=IN/ST=Maharashtra/O=CDAC/O=SMU/OU=NISG/CN=praju/emailAddress=prajaktac(a)cdac.in --> verify return:1 TLS_accept: SSLv3 read client certificate A rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange Segmentation fault I just cannot figure out where exactly its getting stuck. Thank you Prajakta Choudhari __________________________________________________________ Yahoo! India Answers: Share what you know. Learn something new http://in.answers.yahoo.com/

1 0

Re:Problem with logging detail-log to syslog
by Tom Whitehouse 23 May '07

23 May '07

> I want to log all the freeradius (v 1.1.3) logs to syslog (syslog-ng). > I 've already added this to my syslog-ng.conf : > > filter f_radiusd { match ("radiusd"); }; > destination radiuslogs { file("var/log/radiusd.log"); }; > log { source (src); filter(f_daemon); filter(f_radiusd); > destination(radiuslogs);}; > > And I changed/added this in my radiusd.conf : > > logdir = syslog > log_destination = syslog > > So far so good: when I restart syslog-ng and radiusd, radiusd is logging > to /var/log/radiusd.log via syslog. But I also want to have the > detail-logs, which are normaly in the raddact directory, working in > syslog... Now I see this error in /var/log/radiusd.log : > > rlm_detail: Failed to create directory syslog/radacct: No such file or > directory > > So the rlm_detail part doesn't understands the 'logdir = syslog' option > in radiusd.conf I guess? How can I fix this? We created a pipe/FIFO: mkfifo /var/logfifo -m 600 chown radius /var/logfifo Included the pipe/FIFO in the syslog-ng configuration: source src { ...; pipe('/var/logfifo'); ... } Changed the radiusd.conf detail section: detailfile = /var/logfifo Changed all the occurrances of ${logdir} in radiusd.conf for radwtmp/radutmp/sradutmp if being used: from SOMETHING = ${logdir}/SOMETHING to SOMETHING = ${localstatedir}/log/radius/SOMETHING HTH, Tom -- Tom Whitehouse Department of Computer Science, University of York Heslington, York YO10 5DD, United Kingdom email: tomw(a)cs.york.ac.uk | Fax: +44 1904 432767 http://www.cs.york.ac.uk | Voice: +44 1904 434725

1 0

strange thing happening with rlm_perl
by Pedro Figueiredo 23 May '07

23 May '07

hi, i'm using fr 1.1.2 and perl 5.8.4, and wrote a simple perl script to return 2 random lns's for a given huntgroup. $ uname -a Linux radius1_staging 2.6.8-x4100-1 #1 SMP Wed Jun 7 08:58:42 BST 2006 x86_64 GNU/Linux this is what i have in "users", right at the top: # testuser@domain Huntgroup-Name == testhuntgroup Framed-Protocol = PPP, Service-Type = "Dialout-Framed-User" DEFAULT Auth-Type = Perl Fall-Through = 1 DEFAULT Huntgroup-Name == othergroup, Suffix == "@foo" ... # i have radiusd.conf setup as per http://wiki.freeradius.org/Rlm_perl and the following group in authorize: group { ldap { fail = return notfound = return } files { ok = 1 } perl { ok =1 } auth_log ok = return } my perl simply slurps a file with the several lns parameters and returns 2 randomly chosen ones through %RAD_REPLY: sub authorize { # boring file reading and random op... my ( $ip1, $password1, $pref1 ) = @{ $lns[$lns1] }; $RAD_REPLY{'Tunnel-Server-Endpoint:1'} = $ip1; $RAD_REPLY{'Tunnel-Type:1'} = "L2TP"; $RAD_REPLY{'Tunnel-Medium-Type:1'} = "IP"; $RAD_REPLY{'Tunnel-Password:1'} = "$password1"; $RAD_REPLY{'Tunnel-Assignment-Id:1'} = "1"; $RAD_REPLY{'Tunnel-Preference:1'} = "$pref1"; my ( $ip2, $password2, $pref2 ) = @{ $lns[$lns2] }; $RAD_REPLY{'Tunnel-Server-Endpoint:2'} = $ip2; $RAD_REPLY{'Tunnel-Type:2'} = "L2TP"; $RAD_REPLY{'Tunnel-Medium-Type:2'} = "IP"; $RAD_REPLY{'Tunnel-Password:2'} = "$password2"; $RAD_REPLY{'Tunnel-Assignment-Id:2'} = "2"; $RAD_REPLY{'Tunnel-Preference:2'} = "$pref2"; return RLM_MODULE_UPDATED; } what i'm seeing in the respose are mixed av pairs, and the connection fails (i assume because the data for each tunnel is incomplete). here is what i see in the logs and the response sent: rlm_perl: Added pair Tunnel-Assignment-Id = 2 rlm_perl: Added pair Tunnel-Medium-Type = IP rlm_perl: Added pair Tunnel-Type = L2TP rlm_perl: Added pair Tunnel-Server-Endpoint = x.x.x.x rlm_perl: Added pair Tunnel-Password = foo rlm_perl: Added pair Tunnel-Assignment-Id = 1 rlm_perl: Added pair Service-Type = Dialout-Framed-User rlm_perl: Added pair Tunnel-Medium-Type = IP rlm_perl: Added pair Tunnel-Server-Endpoint = y.y.y.y rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Tunnel-Type = L2TP rlm_perl: Added pair Tunnel-Preference = 1 rlm_perl: Added pair Tunnel-Password = bar rlm_perl: Added pair Tunnel-Preference = 50 here it seems to be ignoring the :1 and :2 for each tunnel. this then results in the following reply, with values from borh tunnels mixed: Sending Access-Accept of id 234 to t.t.t.t port 9208 Framed-Protocol = PPP Service-Type = Dialout-Framed-User Tunnel-Assignment-Id:2 = "2" Tunnel-Medium-Type:1 = IP Tunnel-Type:1 = L2TP Tunnel-Server-Endpoint:2 = "x.x.x.x" Tunnel-Password:2 = "foo" Tunnel-Preference:2 = 1 am i doing something wrong, and if so, what? any help much appreciated. thanks in advance, pedro -- This email and any attachments may be confidential and/or legally privileged. If you have received this e-mail and you are not a named addressee, please inform the sender of this email by sending a return email to the address above and then delete the e-mail and your response from your system. If you are not a named addressee you must not use, disclose, distribute, copy, print or rely on this e-mail. Any views or opinions presented are solely those of the author. Any statements made, or intentions expressed in this communication may not necessarily reflect the view of Easynet. No content herein will bind Easynet or any associated company unless confirmed by the execution of a formal contract by Easynet. Any figures or amounts given in this email are quotations only and are subject to change. Although Easynet routinely screens for viruses, addressees should scan this e-mail and any attachments for viruses. Easynet makes no representation or warranty as to the absence of viruses in this e-mail or any attachments. Please note that to ensure regulatory compliance and for the protection of our customers and business, we may monitor and read e-mails sent to and from our server(s). Easynet Limited a company incorporated and existing under the laws of England and Wales, with company number 2954343 and having its registered office at 44-46 Whitfield Street London, W1T 2RJ.

1 0

Problem with logging detail-log to syslog
by Mark van Herpen 23 May '07

23 May '07

Hello, I want to log all the freeradius (v 1.1.3) logs to syslog (syslog-ng). I 've already added this to my syslog-ng.conf : filter f_radiusd { match ("radiusd"); }; destination radiuslogs { file("var/log/radiusd.log"); }; log { source (src); filter(f_daemon); filter(f_radiusd); destination(radiuslogs);}; And I changed/added this in my radiusd.conf : logdir = syslog log_destination = syslog So far so good: when I restart syslog-ng and radiusd, radiusd is logging to /var/log/radiusd.log via syslog. But I also want to have the detail-logs, which are normaly in the raddact directory, working in syslog... Now I see this error in /var/log/radiusd.log : rlm_detail: Failed to create directory syslog/radacct: No such file or directory So the rlm_detail part doesn't understands the 'logdir = syslog' option in radiusd.conf I guess? How can I fix this? Thanks in advance Mark van Herpen

2 4

Problem connecting to a router via RADIUS Server authentication
by prajakta choudhari 23 May '07

23 May '07

Hi all: I have configured the radius server . I have a linksys router with wireless security as RADIUS enabled and laptop that connects to the linksys router. whenever i try connecting to the router i get the folloing message on the machine wiht the radius server. the clients.conf has the secret key as testing123 . In which other file do i have to put the same key. Cleaning up request 4 ID 0 with timestamp 46543306 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 192.168.6.15:2050, id=0, length=129 Received packet from 192.168.6.15 with invalid Message-Authenticator! (Shared secret is incorrect.) Dropping packet without response. Cud someone throw light on this issue Thank you Prajakta Choudhari __________________________________________________________ Yahoo! India Answers: Share what you know. Learn something new http://in.answers.yahoo.com/

3 2