October 2008 - Freeradius-Users - lists.freeradius.org

SQL Query question
by andreiv 17 Oct '08

17 Oct '08

Hi everybody, I'm using 2 Freeradius 2.0.5 servers for writting Accounting Requests into separate Oracle DBs (one for each server ). let's say one of the servers stops. On restart I need the radius server to execute a stored procedure that will syncronize the DBs. is it possible to execute this procedure without any accounting requests coming in ? -- View this message in context: http://www.nabble.com/SQL-Query-question-tp19992564p19992564.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 7

authenticate windows pc to samba/openldap
by alois blasbichler 17 Oct '08

17 Oct '08

Hello list I want to let authenticate the computer-account to radius - naturaly only computers who are in my samba-domain and also stored in my openldap-db like a laptop : uid=inf-lap-1$,ou=samba-computers,dc=sb-brixen,dc=it but from radius i get an error that this laptop was not found - is this a impostation of my client ? What can i do ? here my log by and thanks luis [suffix] No '@' in User-Name = "host/inf-lap-1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 10 length 73 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for host/inf-lap-1 WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=host/inf-lap-1) expand: dc=sb-brixen,dc=it -> dc=sb-brixen,dc=it rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=sb-brixen,dc=it, with filter (uid=host/inf-lap-1) request done: ld 0x8180140 msgid 5 rlm_ldap: object not found or got ambiguous search result [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop

1 0

pool name per nas AND per user
by Alexandre Chapellon 17 Oct '08

17 Oct '08

Hello, I have freeradius authenticating ADSL users (several types ADSL). request are comming from several BAS (my NASes). I would like freeradius to give customers IP addresses from differents IP pools based on the NAS from which the request come from (huntgroups does it perfectly today) but also based on the type for ADSL is authenticated (this information is stored in the sql database and so the NAS is completely unaware of it) ex: As a reminder, i want thoose pools pool_NAS1_ADSL512 pool_NAS1_ADSL1024 pool_NAS2_ADSL512 pool_NAS2_ADSL1024 if i am user1 who owns a 1024kb/s ADSL account, I want to have Pool-Name pool_NAS1_ADSL1024 if the request comes from NAS1 and pool_NAS2_ADSL1024 if the request comes from NAS2...and so on. Any idea?

4 9

Problems with EAP authentication
by Tomislav Goluza 17 Oct '08

17 Oct '08

I have a problem authenticating with Cisco Aironet 1200 access point. I have valid certificates on my laptop and on Freeradius. This is the output on AP: Interface Dot11Radio0, Deauthenticating Station 001e.4c8c.8406 Reason: Sending station has left the BSS Interface Dot11Radio0, Station NBD7FB3G3J 001e.4c8c.8406 Associated KEY_MGMT[NONE] 3 Interface Dot11Radio0, Deauthenticating Station 001e.4c8c.8406 Reason: Previous authentication no longer valid This is what I get on freeradius: [root@radius ~]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "root" main: group = "root" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/server_keycert.pem" tls: certificate_file = "/etc/raddb/certs/server_keycert.pem" tls: CA_file = "/etc/raddb/certs/cacert.pem" tls: private_key_password = "freeradius" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests.rad_recv: Access-Request packet from host 192.168.177.121:1645, id=23, length=149 rad_recv: Access-Request packet from host 192.168.177.121:1645, id=24, length=256 User-Name = "radius.rc.internal" Framed-MTU = 1400 Called-Station-Id = "000f.9093.b5c0" Calling-Station-Id = "001e.4c8c.8406" Service-Type = Login-User Message-Authenticator = 0x6fe0a230a00d77e3336c69daf8d5f435 EAP-Message = 0x020300700d800000006616030100610100005d030148f73a1b8c1dcc0750843f75c1f268c7dc1c034d6fb2487d406bcffe5d6cf4d600003600390038003500160013000a00330032002f0007006600050004006300620061001500120009006500640060001400110008000600030100 NAS-Port-Type = Wireless-802.11 NAS-Port = 261 State = 0x4f843413ae6144aacc887d596ec6161b NAS-IP-Address = 192.168.177.121 NAS-Identifier = "AP" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "radius.rc.internal", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 112 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 159 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0061], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0654], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 010d], ServerKeyExchange TLS_accept: SSLv3 write key exchange A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00a5], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 24 to 192.168.177.121 port 1645 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4091" EAP-Message = 0x0104040a0dc000000864160301004a02000046030148f73ae365e1f568fdc304f234482bb240a3a4c83815c22e71f46149d04fc67620cced767dfe705a0f1ff39a336f762a5982fbf84203e198293e429822cd1999b600390016030106540b00065000064d0002a7308202a33082020ca003020102020101300d06092a864886f70d0101050500308191310b300906035504061302706b311530130603550408130c70616b68746f6f6e6b687761311330110603550407130a6162626f747461626164310f300d060355040a0c06c29e63696974311b3019060355040313127261646975732e72632e696e7465726e616c3128302606092a864886f70d EAP-Message = 0x0109011619726e644070656163652e6e6f7440636969742e6e65742e706b301e170d3038303830343036333034365a170d3039303830343036333034365a308183310b300906035504061302706b311530130603550408130c70616b68746f6f6e6b687761311330110603550407130a6162626f747461626164310d300b060355040a130463696974311b3019060355040313127261646975732e72632e696e7465726e616c311c301a06092a864886f70d010901160d726e644070656163652e6e6f7430819f300d06092a864886f70d010101050003818d0030818902818100c5a299bdab568d9d2cd1d6e53c6af5e2baeec9ffb8c9b29a5031f256 EAP-Message = 0x37c92cc0751ee4787911dbdf4ec0e41c722f80c246da7276928b20cc8a803ee1ef33cf4debdf3bbf831d5f50d022362bfea7894c1099b5302255df7d8be28a1c3c540b6f97e6059a2ac5de07343358214d6b64c20f6bfd3d56324e1a2c9c372ecc4b0df70203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010505000381810013677557b079795d7bd6a10067bcb55a9ccb70ed11143aaed9e7678b0282ac72b05414c42b264b28d23b161758a4bdfab4456459fd5ff8c471be519168062a792e17e274140b9c0860d07e83aa7b2835365172967507debaffed053dd297138db5d8ec5d335655c9 EAP-Message = 0xdbff6196ad607f4b8af88bba741f77227c5b389b902bcd720003a03082039c30820305a003020102020900d0b963753ebde4ab300d06092a864886f70d0101050500308191310b300906035504061302706b311530130603550408130c70616b68746f6f6e6b687761311330110603550407130a6162626f747461626164310f300d060355040a0c06c29e63696974311b3019060355040313127261646975732e72632e696e7465726e616c3128302606092a864886f70d0109011619726e644070656163652e6e6f7440636969742e6e65742e706b301e170d3038303830313037303635325a170d3138303733303037303635325a308191310b3009 EAP-Message = 0x06035504061302706b311530130603550408130c7061 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5dbbf6bd35b4c1f6c4bd34a2cd101387 Finished request 1 Going to the next request Waking up in 6 seconds...

2 1

Send me an SMS
by Sunkara RaviPrakash 17 Oct '08

17 Oct '08

1 0

Username Rewrites based on Hint / Realm
by Javier Fox 16 Oct '08

16 Oct '08

Hi folks, I have a bit of a conundrum trying to implement FreeRadius for a system where users from multiple ISP names must all authenticate in the same place, and I'm hoping a more experienced user can shed some light. In a nutshell, I need to do the following: -Check the 'called-station-id' of an incoming RADIUS request -If the id is A, B, or C, set a hint/realm flag to "alpha" -If the id is D, E, or F, set a hint/realm flag to "beta" -If the id is anything else, set a hint/realm flag to "gamma" -Based on the value of the hint/realm flag, rewrite the username before attempting authentication (by adding '@ispname1', '@ispname2', etc.) -Conversely, if the username already looks like 'user@ispname', leave it alone For completeness' sake, I'm performing the authentication against a Postgres database. In its current state, the system is able to happily authenticate users as long as the username is provided in the format "username@ispname"; otherwise they are rejected. Our old RADIUS system (using Radiator) appears to call a perl script to perform this username rewriting, but that just seems like a nasty hack that I'd prefer to avoid. Any advice on this would be immeasurably appreciated. Thanks, J. Fox

4 11

Error in the negotiations certificates
by Martin Silvero 16 Oct '08

16 Oct '08

I know, but what he does not understand is how to referee when you talk about "cabundle" because what I have in / cert are the certificates that I made in the steps of README, which I did not serve for windows, that the back to delete? when I run the command openssl x509-inform PEM-in-outform DER ca.pem-out ca.der, nothing changes, run and I created a "ca.der," what amount to the notebook and again gives me the same error. log: Sending Access-Challenge of id 190 to 10.0.31.40 port 1645 EAP-Message = 0x010404000dc000000b44160301004a02000046030148f7681908289a36972e0c3b15b0d971036bbe355b9d493d5a4fced4e392e7792010d59ced27c0ac19921ee9205fcc168bbcd8e2e324c80acc31fd8076d8ecc48000390016030108390b000835000832000396308203923082027aa003020102020101300d06092a864886f70d010104050030818c310b3009060355040613024152311530130603550408130c4275656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3120301e06092a864886f70d0109011611636572744069706c616e2e636f6d2e6172311e301c060355 EAP-Message = 0x04031315436572746966696361746520417574686f72697479301e170d3038313031303134353031385a170d3039313031303134353031385a3073310b3009060355040613024152311530130603550408130c4275656e6f73204169726573310e300c060355040a130549504c414e311b3019060355040313125365727665722043657274696669636174653120301e06092a864886f70d0109011611636572744069706c616e2e636f6d2e617230820122300d06092a864886f70d01010105000382010f003082010a0282010100bacfd3d0fa48b30002182ca8ac9a31672b4ad7dcd6b45d7df598774e7af3c4d6cd46447144260ae3daac561a93e7 EAP-Message = 0xd97d8a9889591b5cd3cf6924d4dc5aaa78a8013bde946b633e51abb4b6150fbe66a8743dd34a887f5c731a685c811c5660ba3d68abd028679464d28af4171dea0a3e99a80ba7b75c10d3c5480a319ea9b9ca6a9d14536b6524eb6f559b10f8f326d612836e88d2b28e03a574ede8b7a7bfdde0a7846543a713bb279c81bb681e50609c10ca2b2f5b6b4b2c1683c9a60ae8c7121ce2a81fc124189d4f356dee804a45b49f71547f788006bc247c65a98e81c2359cc537ef1c65d8137aa6cf6b2aff605d4da97c7a5abad17885608d027ddc370203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010104 EAP-Message = 0x050003820101008c4607f2629625d8c81fce1a7e3afddd78428b75078cd3d8e56f27c48c18af5aa4bd56bc0cb18b750abdaf2d2c275f280a10f96b7768982115fde0abe0f0efa32fc684ce1d15512346aae7e8bef802a06b2f4b5013614208f5d32916532e9ba00b2a24da3cf20fdd7137b6792b80a508b0ccd5781446eed07f2afe8b132818d4e82c94200f8561b80f55550f9eb8db6cdb5ad6efa0588cfd3bcfbdfd329ce85ccf598ffdc95d5b06a4b7e2ef5b77fb895acf66969780419bdc0c8c0ecfe9d3978ffafcde51868b257f8c14cf2669cce1d7a6c4b0a3868e9bfff3408d694f2250ff3b9e730ceed97d84e6f21e80062326d63c771a946d EAP-Message = 0x4d7692a192d9ca4b95110004 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfec434f0fcc03929b80b395aebf61421 Thu Oct 16 13:13:13 2008 : Debug: Finished request 142. Thu Oct 16 13:13:13 2008 : Debug: Going to the next request Thu Oct 16 13:13:13 2008 : Debug: Waking up in 4.3 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=191, length=151 User-Name = "cert" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0xa1b889b6c699680d2ff044a1cc9a3ba6 EAP-Message = 0x020400060d00 NAS-Port-Type = Wireless-802.11 NAS-Port = 1194 State = 0xfec434f0fcc03929b80b395aebf61421 NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap-Reconquista-31" Thu Oct 16 13:13:13 2008 : Debug: +- entering group authorize Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 143 Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[preprocess] returns ok Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 143 Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[chap] returns noop Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 143 Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[mschap] returns noop Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 143 Thu Oct 16 13:13:13 2008 : Debug: rlm_realm: No '@' in User-Name = "cert", looking up realm NULL Thu Oct 16 13:13:13 2008 : Debug: rlm_realm: No such realm "NULL" Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[suffix] returns noop Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 143 Thu Oct 16 13:13:13 2008 : Debug: rlm_eap: EAP packet type response id 4 length 6 Thu Oct 16 13:13:13 2008 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[eap] returns updated Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: calling unix (rlm_unix) for request 143 Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: returned from unix (rlm_unix) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[unix] returns notfound Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: calling files (rlm_files) for request 143 Thu Oct 16 13:13:13 2008 : Debug: users: Matched entry cert at line 76 Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[files] returns ok Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: calling expiration (rlm_expiration) for request 143 Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: returned from expiration (rlm_expiration) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[expiration] returns noop Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: calling logintime (rlm_logintime) for request 143 Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: returned from logintime (rlm_logintime) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[logintime] returns noop Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 143 Thu Oct 16 13:13:13 2008 : Debug: rlm_pap: Found existing Auth-Type, not changing it. Thu Oct 16 13:13:13 2008 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[pap] returns noop Thu Oct 16 13:13:13 2008 : Debug: rad_check_password: Found Auth-Type EAP Thu Oct 16 13:13:13 2008 : Debug: auth: type "EAP" Thu Oct 16 13:13:13 2008 : Debug: +- entering group authenticate Thu Oct 16 13:13:13 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 143 Thu Oct 16 13:13:13 2008 : Debug: rlm_eap: Request found, released from the list Thu Oct 16 13:13:13 2008 : Debug: rlm_eap: EAP/tls Thu Oct 16 13:13:13 2008 : Debug: rlm_eap: processing type tls Thu Oct 16 13:13:13 2008 : Debug: rlm_eap_tls: Authenticate Thu Oct 16 13:13:13 2008 : Debug: rlm_eap_tls: processing TLS Thu Oct 16 13:13:13 2008 : Debug: rlm_eap_tls: Received EAP-TLS ACK message Thu Oct 16 13:13:13 2008 : Debug: rlm_eap_tls: ack handshake fragment handler Thu Oct 16 13:13:13 2008 : Debug: eaptls_verify returned 1 Thu Oct 16 13:13:13 2008 : Debug: eaptls_process returned 13 Thu Oct 16 13:13:13 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 143 Thu Oct 16 13:13:13 2008 : Debug: ++[eap] returns handled

2 1

CERT Question
by Charles Plater 16 Oct '08

16 Oct '08

I have freeradius 2.0.5 successfully authenticating 802.1x via MSChapV2. I am trying to use a signed SSL certificate, that is signed by a CA w/ a chained CA certificate (from ipsca.com) I assumed that using a CA signed cert would do away w/ the errors on connection from WPA2 / 802.1x client, but it seems I'm wrong, or I have requested the cert with the incorrect CN. Are there any instructions on using a valid SSL cert so that users are not prompted to verify the cert on first connection? I have looked at the README in the certs directory, and I tried a self signed cert, which gave the same error. -- Charles Plater Lead Application Technical Analyst Internet Services +1-313-577-4620 ab3189(a)wayne.edu

2 3

Error in the negotiations certificates
by Martin Silvero 16 Oct '08

16 Oct '08

Do you referred to this line? ca.der: ca.pem openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der

2 1

Help on Users file, Group name and Pool-Name
by Xiaochen Jing 16 Oct '08

16 Oct '08

Hello all, I encountered a strange problem while editing "users" file. I have Freeradius 2.0.5 and MS SQL working together. When a request coming in, Freeradius forwards it to MS SQL for authentication of username and password, and Freeradius reads Group Name attribute saved in MS SQL. My goal is to have each username associated to a Group Name. Then based on Group Name, Freeradius decides what IP pool to use, and choose the proper Pool-Name attribute. So in "users" file, I created the following: DEFAULT Group := "doctor", Pool-Name := "julienne"-----------------line133 Group := "dentist", Pool-Name := "netplus"-----------------line134 Group := "staff", Pool-Name := "staffnet"-------------------line135 When I execute Freeradius, I got the following error: /usr/local/etc/raddb/users[135]: Syntax error: Previous line is missing a trailing comma for entry DEFAULT root@Server1:/usr/local/etc/raddb# Errors reading /usr/local/etc/raddb/users /usr/local/etc/raddb/radiusd.conf[1085]: Instantiation failed for module "files" /usr/local/etc/raddb/sites-enabled/inner-tunnel[111]: Failed to find module "files". /usr/local/etc/raddb/sites-enabled/inner-tunnel[34]: Errors parsing authorize section. } } Errors initializing modules It seems we need a comma at the end of the line which is not right for check items. So instead of doing that, I changed the sentenses to the following, in "users" file: DEFAULT Group := "doctor", Pool-Name := "julienne" DEFAULT Group := "dentist", Pool-Name := "netplus" Group := "staff", Pool-Name := "staffnet" This time everything works just fine. I successfully execute Freeradius, and for every user in either of the three groups, Freeradius uses proper Pool-Name to fine IP pool, and user gets a proper IP address falling into that pool. So can anyone shed some lights on this? Why it returns two results after I do that change? Seems DEFAULT can only have two lines? Thanks in advance XJ

2 1