October 2008 - Freeradius-Users - lists.freeradius.org

Cisco VPN Radius with expiry & Windows domain password expiration
by kesm0724 12 Oct '08

12 Oct '08

Hello All, I have a cisco vpn concentrator and in the past have had it pointed to a Windows IAS Server. I have now switched to Freeradius and have discovered that when a user needs to "Change password on next logon" the cisco vpn client does not prompt for a password change. Prior to moving to Freeradius the password change prompt comes up allowing the user to change their password. On the concentrator I do have "Radius with Expiry" configured and have switched back and forth between the IAS Server and the Freeradius server to ensure it was something particular to the authentication servers not the concentrator. I notice the following in debug: rlm_mschap: Told to do MS-CHAPv2 for test with NT-Password expand: --username=%{mschap:User-Name} -> --username=test mschap2: 83 expand: --challenge=%{mschap:Challenge:-00} -> --challenge=04e843995bfbdbca expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=a378afdf127434783890d2e2e4f9d5bd97976a00d2c51fa4 Exec-Program output: Must change password (0xc0000224) Exec-Program-Wait: plaintext: Must change password (0xc0000224) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect I have been looking on Google for windows domain password expiry + freeradius amongst other search strings all to no avail. Can anyone tell me what I'm doing wrong? Thanks. -- View this message in context: http://www.nabble.com/Cisco-VPN-Radius-with-expiry---Windows-domain-passwor… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

FR 2.1.1 compile failed - Solaris 5.10 x86 64-bit
by Chris Howley 12 Oct '08

12 Oct '08

All, FR2.1.1, Solaris 5.10 x86 64-bit ./configure --enable-developer --without-rlm_perl bash-3.00# gcc -v Reading specs from /usr/sfw/lib/gcc/i386-pc-solaris2.10/3.4.3/specs Configured with: /builds/sfw10-gate/usr/src/cmd/gcc/gcc-3.4.3/configure --prefix=/usr/sfw --with-as=/usr/sfw/bin/gas --with-gnu-as --with-ld=/usr/ccs/bin/ld --without-gnu-ld --enable-languages=c,c++ --enable-shared Thread model: posix gcc version 3.4.3 (csl-sol210-3_4-branch+sol_rpath) The latest source code from git.freeradius.org failed to compile. Any help in fixing this problem would be appreciated. Thanks, Chris Howley gmake[4]: Entering directory `/sandbox/radiusd/src/lib' /bin/sh /sandbox/radiusd/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -D_LIBRADIUS -I/sandbox/radiusd/src -c dict.c /sandbox/radiusd/libtool: syntax error at line 650: `func_arith_result=$' unexpected gmake[4]: *** [dict.lo] Error 2 gmake[4]: Leaving directory `/sandbox/radiusd/src/lib' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/sandbox/radiusd/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/sandbox/radiusd/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/sandbox/radiusd' gmake: *** [all] Error 2

2 1

Asking freeradius for the status
by Michael Schwartzkopff 11 Oct '08

11 Oct '08

Hi, I am just digging into the status server of freeradius. I read man radclient and the comments of status server. But it seems I do nat have the right clue: 1) Copying the example from the man pages of radclient: $ echo "Message-Authenticator = 0x00" | radclient localhost sta tus testing123 results in: Received response ID 137, code 2, length = 20 and not, as described in the manual. What is my error? The logfile of radiusd is: rad_recv: Status-Server packet from host 127.0.0.1 port 32770, id=137, length=38 Message-Authenticator = 0xf068e18b120a18d84d00a1dba1cba97d Sending Access-Accept of id 137 to 127.0.0.1 port 32770 Finished request 0. Cleaning up request 0 ID 137 with timestamp +6 Going to the next request Ready to process requests. 2) How to get other status info from the server? Using the FreeRADIUS-Statistics-Type attribute? How exactly? Please post an example. Thanks for any hints. Sincerely, Michael Schwartzkopff.

2 1

ldap/krb5 auth and access point Authentication methods ?
by FM 11 Oct '08

11 Oct '08

Hello, We are using openldap/kerberos (MIT) and just bought 2 CISCO Aironet 1250. I'd like to use freeradius to auth. our users. I read that freeradius can use openldap and kerberos, so i suppose I will setup these for auth. Most of my Wi-Fi users will be Windows/Mac Os and I'd like to avoid custom installation on the laptops. The question is : Which auth method should I use on the access points ? tx !

3 2

Dialup admin questions
by Frederik.Niedernolte＠Bertelsmann.de 10 Oct '08

10 Oct '08

Does it make it sense to use dialup admin for administration if the freeRADIUS server uses the active directory for authentification? Because I have the following errors in the interface: Warning: asort() expects parameter 1 to be array, null given in /usr/share/freeradius-dialupadmin/htdocs/accounting.php3 on line 47 Warning: mktime() expects parameter 1 to be long, string given in /usr/share/freeradius-dialupadmin/lib/functions.php3 on line 95 Warning: mktime() expects parameter 1 to be long, string given in /usr/share/freeradius-dialupadmin/lib/functions.php3 on line 95 DEBUG(SQL,MYSQL DRIVER): Query: SELECT COUNT(radacctid) AS res_1,sum(acctsessiontime) AS res_2,sum(acctoutputoctets) AS res_3 FROM radacct WHERE username LIKE '%' AND acctstoptime >= '2008-10-11 00:00:00' AND acctstoptime <= '2008-10-11 23:59:59' ; Database query failed: Table 'radius.radacct' doesn't exist DEBUG(SQL,MYSQL DRIVER): Query: SELECT COUNT(radacctid) AS res_1,sum(acctsessiontime) AS res_2,sum(acctoutputoctets) AS res_3 FROM radacct WHERE username LIKE '%' AND acctstoptime >= '2008-10-03 00:00:00' AND acctstoptime <= '2008-10-03 23:59:59' ; Database query failed: Table 'radius.radacct' doesn't exist How should I fix them? Thanks. F. Niedernolte

3 4

EAP MSK: how is it transported between server and authenticator
by Richard Chan 10 Oct '08

10 Oct '08

Hi all, After an EAP authentication which supports key derivation (MSK) how does freeradius transport the MSK to an NAS(authenticator)? I.e., what kind of attribute is used? (I am assuming that the EAP Server (freeradius) is a separate entity to the NAS; NAS talks to freeradius using RADIUS and acts as EAP proxy between EAP client and freeradius). There is an IETF draft on encrypted RADIUS attributes (which specifically mentions "EAP MSK"): http://www.ietf.org/internet-drafts/draft-zorn-radius-encattr-14.txt but this seems too recent to be actually used in the field (besides including undefined magic numbers). Browsing another RADIUS server document (Cisco Secure ACS), there is a "RADIUS Key Wrap" secret that can be configured. Presumably this is used to send MSKs between server and authenticator, but once again there are no details on how it is actually done. I couldn't find a similar configuration parameter in the freeradius config files, either radiusd.conf ( http://wiki.freeradius.org/Radiusd.conf) or the client side ( http://wiki.freeradius.org/Clients.conf) Googling 'radius key wrap' etc doesn't lead to further enlightenment. Tks! -richard-

4 11

Please Help!
by niel m 10 Oct '08

10 Oct '08

Hello Guys Im new in radius, I am using CentOS 5 in my radius server. Where I can find the scripts in generating various Certificates? This is for my Server-(Access Point)-Client connections. Any help would be appreciated. Thanks, Niel

2 3

Radius reply multivalue VSA question.
by Eric Martell 10 Oct '08

10 Oct '08

Hi, We are defining custom VSA's for our company. We have ldap configured in freeradius which returns back the VSA's. I defined custom VSA in $freeradius/share/freeradius/dictionary.abc ATTRIBUTE rEntitlements 113 string entitlements is multivalue attribute (vARRAY) in LDAP. In the ldap.attrmap it is defined as replyItem rEntitlements entitlements == So after the successful authentication, I am getting the rEntitlements back as Sending Access-Accept of id 50 to 69.74.69.31 port 1814 Session-Timeout = 7200 rEntitlements == "ADMALL" rEntitlements == "STORE" rEntitlements == "WEPG" rEntitlements == "WADM" rEntitlements == "SDNLD" rEntitlements == "WIFILOC1" BUT I am looking for ONLY WIFILOC1 for the NAS. NAS will redirect if WIFILOC1 exists. Can I do regex in the rEntitlements so freeradius ONLY returns rEntitlements = "WIFILOC1" and ignore the rest? Please let me know. Thanks in advance.

2 9

Error in the negotiations
by Martin Silvero 09 Oct '08

09 Oct '08

Is this the issue that you say?: Re: CA.all and CA.certs in Freeradius 2.x<https://lists.freeradius.org/pipermail/freeradius-users/2008-October/msg002…>

2 1

FreeRADIUS and EDUROAM timeout issues
by Peter Eriksson 09 Oct '08

09 Oct '08

How have other EDUROAM sites configured their EDUROAM servers with regard to timeout issues? The default setting seems to be less than optimal since if a remote site have problems with their home RADIUS servers then we risk having our local servers mark the upstream servers as "dead" since it's not receiving answers for a specific 'realm'... I've been using the default values so far: response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 But I wonder if these can be tuned a bit to better work in the EDUROAM environment. Perhaps increase the 'response_window', and lower 'zombie_period' and 'revive_interval' and 'check_interval' values... Best would probably be if FreeRadius kept a separate timeout for each 'server/realm' tuple... What have other sites done? - Peter

4 10