November 2008 - Freeradius-Users - lists.freeradius.org

pam_radius_auth v1.3.17 missing a define???
by David Ly 25 Nov '08

25 Nov '08

Hi, I've been looking into the source code of pam radius, due to authentication failure without a entry in the local /etc/passwd file, and i've noticed that; /|'PAM_SM_ACCOUNT|/ must be *#define*'d prior to including |<security/pam_modules.h>|.' isn't being done. Was this done on purpose? Could this possibly be factor in my problem. I would test it out, however I am unable to build the library on my machine. A fresh downloaded make gives me Nov 21 15:20:52 wisdur sshd[21221]: PAM unable to dlopen(/lib/security/pam_radius_auth.so): /lib/security/pam_radius_auth.so: undefined symbol: __stack_chk_fail_local Nov 21 15:20:52 wisdur sshd[21221]: PAM adding faulty module: /lib/security/pam_radius_auth.so Thanks in advance -David Ly (Just a side note, Does anyone knows why I get these errors when trying to build.) ggc -v ---> "gcc version 4.1.1" pam_radius_auth.c: In function ‘talk_radius’: pam_radius_auth.c:887: warning: pointer targets in passing argument 6 of ‘recvfrom’ differ in signedness pam_radius_auth.c: In function ‘pam_sm_authenticate’: pam_radius_auth.c:1103: warning: assignment from incompatible pointer type

2 2

last hurdle...windows clients
by Craig White 25 Nov '08

25 Nov '08

freeradius-1.1.3-1.2.el5 I am authenticating Windows RRAS connections, Macintosh wifi, iPhone wifi all with LDAP and mschapv2 (using sambaNTPassword hashes in OpenLDAP) My users basically consists of... DEFAULT Auth-Type = LDAP eap.conf default_eap_type = mschapv2 and of course my certificates and LDAP setup which works for all the above authentications. My problem is Windows XP laptops (updated to SP3) and I have generated certificates for them. I have loaded both the CA and p12 certificates on a Windows client, set for WPA, TKIP, PEAP but it never asks me for a user name and password and thus always tries to authenticate as anonymous (log below)...even if I check the box to 'Automatically use my Windows name and password' - it still comes in as 'anonymous' Is there some thing else I need to add so that Windows also uses name/password or do I have something else in Auth-Type to just allow those with the certificates? How do I do this? I don't understand the message about unknown_ca in the log below either because I am acting as my own CA and this same cacert.pem seems to be happy on the Windows system I imported it on and I've been using it for a bunch of other daemons. Craig rad_recv: Access-Request packet from host 192.168.1.251:2050, id=112, length=172 User-Name = "anonymous" NAS-IP-Address = 192.168.1.251 NAS-Port = 0 Called-Station-Id = "00-21-29-E3-D1-8A" Calling-Station-Id = "00-04-23-62-BD-3D" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0288001119800000000715030100020230 State = 0xce80cf1b72bd9479de376550dc6d9052 Message-Authenticator = 0x90183570c2ef1940d04e9e5dc579a1bd Processing the authorize section of radiusd.conf modcall: entering group authorize for request 59 modcall[authorize]: module "preprocess" returns ok for request 59 modcall[authorize]: module "chap" returns noop for request 59 modcall[authorize]: module "mschap" returns noop for request 59 rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 59 rlm_eap: EAP packet type response id 136 length 17 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 59 users: Matched entry DEFAULT at line 156 modcall[authorize]: module "files" returns ok for request 59 rlm_ldap: - authorize rlm_ldap: performing user authorization for anonymous radius_xlat: '(uid=anonymous)' radius_xlat: 'ou=People,ou=Accounts,o=MyOrg' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,ou=Accounts,o=MyOrg, with filter (uid=anonymous) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 59 modcall: leaving group authorize (returns updated) for request 59 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 59 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept:failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode rlm_eap: SSL error error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 59 modcall: leaving group authenticate (returns reject) for request 59 auth: Failed to validate the user.

3 8

Re: failure to compile 2.1.1 on Redhat ES3
by thoralf.freitag＠biotronik.com 25 Nov '08

25 Nov '08

>A.L.M.Buxey at lboro.ac.uk wrote: >> just tried to compile FR 2.1.1 on a more vintage system >> than what I normally find myself on - RedHat ES 3 >> >> Theres a compile issue with Python module which didnt >> exist on the same platform with 2.0.5 - but I'll ignore >> that one for now - the important part is the base daemon >> itself: >> >> /usr/src/freeradius-server-2.1.1/libtool --mode=compile gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall >-D_GNU_SOURCE -DNDEBUG -I/usr/src/freeradius-server-2.1.1/src -DHOSTINFO=\"i686-pc-linux-gnu\" >-DRADIUSD_VERSION=\"2.1.1\" -DOPENSSL_NO_KRB5 -c listen.c >> gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG >-I/usr/src/freeradius-server-2.1.1/src -DHOSTINFO=\"i686-pc-linux-gnu\" -DRADIUSD_VERSION=\"2.1.1\" -DOPENSSL_NO_KRB5 >-c listen.c -fPIC -DPIC -o .libs/listen.o >> listen.c:99:1: directives may not be used inside a macro argument > > Yuck. That assert can simply be deleted. > > Alan DeKok. Hi Alan, pls. give me a little hint, what exact can be deleted ? -- Thoralf Freitag Manager Health Services System Administration Phone: +49 (0) 30 68905-4611 Cellular:+49 (0) 151 1631-4611 Fax: +49 (0) 30 68905-2940 Mail: Thoralf.Freitag(a)biotronik.com www.biotronik.com BIOTRONIK GmbH & Co. KG Woermannkehre 1, 12359 Berlin, Germany Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRA 6501 Vertreten durch ihre Komplementärin: BIOTRONIK Mess- und Therapiegeräte GmbH Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRB 2918 Geschäftsführer: Dr. Max Schaldach, Christoph Böhmer, Dr. Werner Braun, Dr. Lothar Krings This email and the information it contains including attachments are confidential and meant only for use by the intended recipient(s); disclosure or copying is strictly prohibited. If you are not addressed, but in the possession of this email, please notify the sender immediately and delete the document.

2 2

Linksys WAP54G
by M.K. tenNapel 25 Nov '08

25 Nov '08

Hi, I have setup a FreeRadius-server and try to get it operational with a Linksys WAP54G AccessPoint. This seems to work highly unreliable. I posted a question about this on the Linksys support forums, but no luck so far: http://forums.linksys.com/linksys/board/message?board.id=Access_Points&thre… Googeling this problem, I found more complaints about this issue. I was wondering if more FreeRadius users are familiar with this problem. Maybe someone came up with a solution? I hate to throw out 3 AP's... Thanks! Mariourk

5 11

certificates confusion
by Craig White 25 Nov '08

25 Nov '08

please excuse me if this isn't entirely related to freeradius but it's all about getting WindowsXP laptops to my wireless network with freeradius and 8021.x I see that there is certificate failures and am thinking that I need to clean this up up until now, server2 is my ca and I have used that to generate and sign certificates. my radius server though is running on server1 and I think that my failure is related to the fact that I'm generating the certificates and signing them with server2. So my questions... 1. Do I set up server1 to be its own CA or do I still use server2 as the CA? 2. If server2 is the CA, do I then generate the request on server1, copy it to server2 and then sign it on server2? 3. Does anyone see any problems with these methods of generating certificates ? (openssl on Linux) # Generate server certificate signing request openssl req -new -nodes -keyout $SSL/radius_server_key.pem \ -out $SSL/radius_server_req.pem \ -days 730 \ -config $SSL/openssl.cnf # Sign server certificate openssl ca -config $SSL/openssl.cnf \ -policy policy_anything \ -out radius_server_cert.pem \ -extensions xpserver_ext \ -extfile $SSL/xpextensions \ -infiles $SSL/radius_server_req.pem # Edit out text information in radius_server_cert.pem and then run # cat $SSL/radius_server_key.pem \ # $SSL/radius_server_cert.pem > \ # $SSL/radius_server_keycert.pem # Generate client certificates # openssl req -new -keyout $SSL/radius_client_key.pem \ -out $SSL/radius_client_req.pem \ -days 730 \ -config $SSL/openssl.cnf # Sign client certificates openssl ca -config $SSL/openssl.cnf \ -policy policy_anything \ -out $SSL/radius_client_cert.pem \ -extensions xpclient_ext \ -extfile $SSL/xpextensions \ -infiles $SSL/radius_client_req.pem # cat $SSL/radius_client_key.pem $SSL/radius_client_cert.pem > $SSL/radius_client_keycert.pem Thanks Craig

5 7

Unlang / Username modification
by Nemec Christopher 25 Nov '08

25 Nov '08

Hello list; our freeradius is used to authenticate MAC-addresses (locally) and "humans" (against the windows AD). Therefor I would to like use unlang to seperate MAC-addresses from humans as they need to be treated differentely; the MAC-address authentication works fine; so does the proxying to the realm called "office". However I am stuck with these two tasks: a) Append the "office" prefix to the username (since we are lazy and do not want to type in the domain name when we log on to one of our switches) b) proxy the request to the AD I have placed the following lines of code in the radiusd.conf file: if (User-Name="nemec") { %{User-Name}:=office\nemec Proxy-To-Realm := "office" } However they are not being executed. Do they need to be at the top of the file? Is the syntax correct? radiusd -X runs with no errors and correctly processes all other requests, but does not proxy to the "office" realm. Christopher Oesterreichische Lotterien Gesellschaft m.b.H., Rennweg 44, A-1038 Wien, FN 54472 g, Handelsgericht Wien, DVR-Nr: 0476706

2 1

How to interpret rlm_ippool_tool output ?
by thoralf.freitag＠biotronik.com 25 Nov '08

25 Nov '08

Hi, I am using the ipppol modul. To check, wether IPs will put back to the pool, after them freed, sometimes I take a look to the IP-Pool. sudo /opt/radius/bin/rlm_ippool_tool -av /opt/radius/etc/raddb/db.ippool.one /opt/radius/etc/raddb/db.ipindex.one shows something like this: KEY: '9680138403a6e74f3b73aac7df6999b0' - ipaddr:10.0.194.251 active:1 cli:0 num:1 KEY: '713fff05450587a3211ea1f508fa8aeb' - ipaddr:10.0.194.32 active:1 cli:0 num:0 In my understanding the first is th unique key build as configured. TSsecond is very clear. But then active:1 means this IP is used ? cli:0 I saw no other then 0 ? num: 0|1 I have no idea what this means Can anybody help me ? -- Thoralf Freitag Manager Health Services System Administration Phone: +49 (0) 30 68905-4611 Cellular:+49 (0) 151 1631-4611 Fax: +49 (0) 30 68905-2940 Mail: Thoralf.Freitag(a)biotronik.com www.biotronik.com BIOTRONIK GmbH & Co. KG Woermannkehre 1, 12359 Berlin, Germany Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRA 6501 Vertreten durch ihre Komplementaerin: BIOTRONIK Mess- und Therapiegeraete GmbH Sitz der Gesellschaft: Berlin, Registergericht: Berlin HRB 2918 Geschaeftsfuehrer: Dr. Max Schaldach, Christoph Boehmer, Dr. Werner Braun, Dr. Lothar Krings This email and the information it contains including attachments are confidential and meant only for use by the intended recipient(s); disclosure or copying is strictly prohibited. If you are not addressed, but in the possession of this email, please notify the sender immediately.

1 1

WPA Supplicant - EAPOL-TEST
by Surendranath.C. 25 Nov '08

25 Nov '08

I am not able to execute the file eapol_test after making the necessary changes as described in the link below: http://deployingradius.com/scripts/eapol_test/ The message that I am getting is as below: [root@testradiusdgp wpa_supplicant-0.5.10]# make eapol_test Make: `eapol_test' is up to date Need your inputs to proceed further. Thanks & Regards, Surendranath Chandranath

1 0

Capture the MAC address of VPN connecting devices in FreeRadius
by Lucio Godoy 24 Nov '08

24 Nov '08

Hi All; Is it possible to capture in Freeradius the MAC address of a device connecting via a VPN server (Cisco VPN 3000 or Microsoft PPTP Server), pls? The user has a Username/Password Combination which isn't the MAC Address. Thank you. Lucio _________________________________________________________________ See the most popular videos on the web http://clk.atdmt.com/GBL/go/115454061/direct/01/

6 8

question
by Jackson Jerry-NPC637 24 Nov '08

24 Nov '08

Hi - Summary - I want/need to configure free radius to allow a TLS user on to the system; without having To authenticate the certs? I am not sure if this is possible, but wanted to ask if there was a way to bypass TLS cert authentication. I did set the Default-auth-type = Accept; got a `Login Ok' response from free radius; but the user still wasn't able to get network entry? Any options? Thanks, Jerry Login OK: [001DE104702B(a)xohm.com/<no User-Password attribute>] (from client PAYLOAD_SET65537 port 1 cli 001de104702b) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 43 radius_xlat: '/usr/local/var/log/radius/radacct/192.168.104.41/reply-detail-20081121' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m %d expands to /usr/local/var/log/radius/radacct/192.168.104.41/reply-detail-20081121 modcall[post-auth]: module "reply_log" returns ok for request 43 modcall: leaving group post-auth (returns ok) for request 43 Sending Access-Accept of id 110 to 192.168.104.41 port 33039 Reply-Message = "Default = Accept" Finished request 43 Going to the next request

3 3