June 2007 - Freeradius-Users - lists.freeradius.org

RE: Freeradius-Users Digest, Vol 26, Issue 120
by Hugh Messenger 25 Jun '07

25 Jun '07

"Flavio Silvestrone" <drascii(a)gmail.com> said: > Subject: Re: "Clear text password not available" > The version of radius is "freeradius-1.0.1-3". All together now: "Upgrade to 1.1.6" I've kind of lost track of exactly what you are trying to do, but what the users file is seems to be set up to do is to authenticate 'massi' locally in the users file, and flavio against the UNIX passwd file. And UNIX is telling you it doesn't know anything about 'flavio'. I think. But definitely upgrade to 1.1.6, regardless!! -- hugh

3 2

RE: Simultaneous-Use problem.
by Josh Howlett 25 Jun '07

25 Jun '07

> On Monday 25 June 2007 11:42:08 Josh Howlett wrote: > > I have a feeling that the answer is blindingly obvious, but I can't > > figure it out... > > > > The 'users' file consists of: > > > > DEFAULT Auth-Type = Accept > > Simultaneous-Use := 1 > > Because Simultaneous-Use is in the wrong place. Make it a > check item and the session section should be processed. That fixed it. As I thought, blindingly obvious; a case of needing another pair of eyes... Thanks, josh.

1 0

Simultaneous-Use problem.
by Josh Howlett 25 Jun '07

25 Jun '07

I have a feeling that the answer is blindingly obvious, but I can't figure it out... The 'users' file consists of: DEFAULT Auth-Type = Accept Simultaneous-Use := 1 In radiusd.conf I also have: session { sql } authorize { radius-user-auth } 'radius-user-auth' is an rlm_exec instance that invokes a script used to authenticate users. It works fine, but the 'session' section never gets processed. Why? josh.

2 1

Re:users authentication failed
by Carl aniams 25 Jun '07

25 Jun '07

> > Carl aniams wrote: > ... > > please any suggestion > ... > > WARNING: Unprintable characters in the password. ? Double-check the > > shared secret on the server and the NAS! > > What part of that message is unclear? Be sure that i crossed check the shared secret on my server and on the nas (the AP) yet nothing i even changed them yet nothing Alan DeKok. > > > ------------------------------ > > > -- > -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ > > ANIAMBOSSOU Carl > NIAMS TECHNOLOGIES > tel: +229 90 04 08 58 +229 97 48 01 33 > COTONOU > REPUBLIC OF BENIN > WEST AFRICA

2 1

terminating EAP tunnels, proxy and realms
by Andreas Liebe 25 Jun '07

25 Jun '07

Hi all, we're using FreeRadius 1.1.6 to give access to our WLAN with EAP-TTLS. Worked great so far. No we want to participate in inter University roaming (eduroam) and thus have to proxy some requests a parent server. Everything works great except regarding the outer identity. If it's just "anonymous" everything is ok, but if it's "anonymous@<somerealm>" and <somerealm> is configured in proxy.conf the EAP-Request ist proxied instead of terminated. This is correct by configuration but not wanted. Is there a way to terminate the EAP regardless of the outer identity? Here's an example: User-Name = "anonymous(a)tu-darmstadt.de" Calling-Station-Id = "00-18-DE-B5-3A-E2" ... EAP-Message = 0x0201001e01616e6f6e796d6f75734074752d6461726d73746164742e 6465 Message-Authenticator = 0x7a211176339c3e2ee9f7a0fe56864b2a ... rlm_realm: Looking up realm "tu-darmstadt.de" for User-Name = "anonymous(a)tu-darmstadt.de" rlm_realm: Found realm "tu-darmstadt.de" rlm_realm: Adding Stripped-User-Name = "anonymous" rlm_realm: Proxying request from user anonymous to realm tu-darmstadt.de rlm_realm: Adding Realm = "tu-darmstadt.de" rlm_realm: Preparing to proxy authentication request to realm "tu-darmstadt. de" modcall[authorize]: module "suffix" returns updated for request 6 rlm_eap: Request is supposed to be proxied to Realm tu-darmstadt.de. Not doing EAP. modcall[authorize]: module "eap" returns noop for request 6 ... How can I bypass proxy authentication for EAP-Messages? This is the setup in users: ... # matches request without any realm (local) DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Realm !* "NULL", Proxy-To-Realm := MyRealm User-Name = `%{User-Name}`,Fall-Through = Yes # matches requests going explicitly to tu-darmstadt.de (local) DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Realm == "tu-darmstadt.de", Proxy-To-Realm := MyRealm User-Name = `%{User-Name}`,Fall-Through = Yes # matches requests going parent radius DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Realm == DEFAULT, Proxy-To-Realm := Parent User-Name = `%{User-Name}`,Fall-Through = Yes ... Thanks a lot, -Andreas -- Andreas Liebe/Darmstadt University of Technology/+49 6151 16-3150/3050(FAX)

5 13

re： Problem on freeradius+openldap+tls
by Hangjun He 25 Jun '07

25 Jun '07

freeradius version 1.1.6 openldap version 2.3.23 opensll verson 0.9.7g Hangjun He <elmerhe(a)yahoo.com.cn> 写道： hi, freeradis with openldap is OK when use cleartext communication. Now I want to use tls. openssl s_client -connect 127.0.0.1:636 -showcerts -state -CAfile /usr/local/etc/openldap/ssl/cacert.pem show the cacert /cert/key is correct. But when I use freeradis with tls, errors pup up: freeradius error: rlm_ldap: - authorize rlm_ldap: performing user authorization for hwang radius_xlat: '(uid=hwang)' radius_xlat: 'ou=People,dc=aerohive,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/etc/openldap/ssl/cacert.pem rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: ldap_start_tls_s() rlm_ldap: could not start TLS Connect error rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 openldap error: TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write server done A tls_write: want=902, written=902 ...... TLS trace: SSL_accept:SSLv3 flush data tls_read: want=5, got=5 0000: 15 03 01 00 02 ..... tls_read: want=2, got=2 0000: 02 2a .* TLS trace: SSL3 alert read:fatal:bad certificate TLS trace: SSL_accept:failed in SSLv3 read client certificate A TLS: can't accept. TLS: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate s3_pkt.c:1052 connection_read(11): TLS accept failure error=-1 id=5, closing connection_closing: readying conn=5 sd=11 for close connection_close: conn=5 sd=11 daemon: removing 11 When I use freeradius in the same host with openldap, There are other errors: connection_get(10) connection_get(10): got connid=11 connection_read(10): checking for input on id=11 TLS trace: SSL_accept:before/accept initialization TLS trace: SSL_accept:SSLv3 read client hello A TLS trace: SSL_accept:SSLv3 write server hello A TLS trace: SSL_accept:SSLv3 write certificate A TLS trace: SSL_accept:SSLv3 write certificate request A TLS trace: SSL_accept:SSLv3 flush data TLS trace: SSL_accept:error in SSLv3 read client certificate A TLS trace: SSL_accept:error in SSLv3 read client certificate A connection_get(10) connection_get(10): got connid=11 connection_read(10): checking for input on id=11 TLS trace: SSL_accept:SSLv3 read client certificate A TLS trace: SSL_accept:SSLv3 read client key exchange A TLS trace: SSL_accept:SSLv3 read finished A TLS trace: SSL_accept:SSLv3 write change cipher spec A TLS trace: SSL_accept:SSLv3 write finished A TLS trace: SSL_accept:SSLv3 flush data connection_read(10): unable to get TLS client DN, error=49 id=11 connection_get(10) connection_get(10): got connid=11 connection_read(10): checking for input on id=11 ber_get_next ber_get_next: tag 0x30 len 5 contents: ber_get_next TLS trace: SSL3 alert read:warning:close notify partly configuration in slapd.conf: TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCACertificateFile /usr/local/etc/openldap/ssl/cacert.pem TLSCertificateFile /usr/local/etc/openldap/ssl/servercrt.pem TLSCertificateKeyFile /usr/local/etc/openldap/ssl/serverkey.pem TLSVerifyClient try Can anyone tell me why it is? Anything wrong with my configure file. Thanks! John --------------------------------- 抢注雅虎免费邮箱3.5G容量，20M附件！ --------------------------------- 抢注雅虎免费邮箱-3.5G容量，20M附件！

2 2

users authentication failed
by Carl aniams 25 Jun '07

25 Jun '07

hi i am using freeradius 1.1.6 with mysql 4 on a fedora core 4 with a DD-WRT v23 with enabled chilli. i have the users created through the dialupadmin page. users are successfully created but while trying to log through chilli i have the following when i do radiusd -X please any suggestion welcome Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.3:2051, id=0, length=197 User-Name = "akim" User-Password = "\332%\300D\310\373h\345]\237\036\216\242\373\362\001" NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.2 Calling-Station-Id = "00-90-4B-A4-D0-E8" Called-Station-Id = "00-18-F8-68-09-F5" NAS-Identifier = "hotspot" Acct-Session-Id = "467fca8f00000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x23a39f4c2fabd6436787a53362759cf8 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "akim", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'akim' rlm_sql (sql): sql_set_user escaped user --> 'akim' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'akim' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'akim' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'akim' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'akim' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: [akim]: invalid password modcall[authenticate]: module "unix" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.168.1.3 port 2051 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 467fb396 Nothing to do. Sleeping until we see a request. -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

3 2

reference guide...
by suganthi V 25 Jun '07

25 Jun '07

Hi all, I am new to freeradius. I want to understand the over all code flow and design of freeradius. Can anyone suggest any reference guide for understanding the design of freeradius please??????? I went thro some manuals of freeradius. But they r theoritical, explaining about radius configurations and packet formats. But i want to understand the design of that... Please help me if u know some guide..... Thanks a lot..... --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

2 3

RE: terminating EAP tunnels, proxy and realms
by Josh Howlett 25 Jun '07

25 Jun '07

> > Nope; see RFC 3579 for the gory details: > > > > "the NAS MUST copy the contents of the Type-Data field of the > > EAP-Response/Identity received from the peer into the User-Name > > attribute" > > > > See thats what I suspected, else how could the User-Name > attribute be populated in the access requests... > And indeed as the RFC states, the User-Identity needs to be > set in the access requests for none EAP aware proxies. I > suspect FreeRADIUS may count as one of these, as for all > intensive purposes as it provides no mechanism to proxy > arbitrary segments of an EAP conversation on inner identity alone. > Unless I missed something ? No, that's correct. > > For the reason given above, it *does* need to understand the > > EAP-Identity-Response. But that's about it! The NAS is a > pretty dumb > > device. > > Reason why I was asking is because most of the tests on the > JRS test website seem to break when you base the reply in > FreeRADIUS, on the inner identity as opposed to the outer identity. I'm surprised at that, IIRC (and I did write the code originally :-) the tests use the same name for inner and outer. Still, it would probably be best if you raised a ticket with JANET Customer Services as this is a bit OT for this list. best regards, josh.

1 0

cvs.freeradius.org failure?
by Milan Holub 25 Jun '07

25 Jun '07

Hi Alan, is it possible that something is wrong with freeradius cvs? I can't log in as anoncvs nor I can do diffs or whatever. Client just hangs - eg.: `cvs -d:pserver:anoncvs@cvs.freeradius.org:/source login` Logging in to :pserver:anoncvs@cvs.freeradius.org:2401/source CVS password: ==> nothing happens for a long time cvs [login aborted]: received interrupt signal ==> killed by ctrl-c Please advise. With regards. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 2