December 2008 - Freeradius-Users - lists.freeradius.org

RE: client certs
by Jason Wittlin-Cohen 10 Dec '08

10 Dec '08

Craig, Apparently Windows automatically sends non-CA certificates in DER or PEM format to the "Other People' certificate store. More importantly, the wireless supplicant in Windows XP \will not work with PEM or DER formatted client certificates. It'll complain that you have no certificate. You must convert to pkcs12 as the documentation states. openssl pkcs12 -export -in certname.pem \ -inkey keyname.key -out name.p12 -clcerts* * Jason -- Jason Wittlin-Cohen Yale Law School, Class of 2010 jason.wittlin-cohen(a)yale.edu (908) 420-0861

3 4

RE: client certs
by Jason Wittlin-Cohen 10 Dec '08

10 Dec '08

>server certs seem fine but generated client cert in Windows shows >"Windows does not have enough information to verify" and yes, I have >loaded the 'ca.der' file generated by the instructions on the Windows >client and that installs in 'Trusted Root Authorities'. The 'client' >cert seems to install in 'Other People', and does include the >XPextensions stuff. > >Craig Craig, You have to install the root certificate and client certificate to the correct certificate store. You have two options - the machine store or the personal certificate store of your current Windows user. The personal certificate store is probably what you want. Double click the client certificate, select "install certificate" and choose "Place the certificate in the following store". Select the "Personal" certificate store. That should solve your problem. Jason -- Jason Wittlin-Cohen Yale Law School, Class of 2010 jason.wittlin-cohen(a)yale.edu

3 2

Which version?
by Just E. Mail 10 Dec '08

10 Dec '08

OK.. I am ready to install freeRADIUS!. I have setup a LINUX server with: CentOS 5.2 mySQL-server-5.0.25-7 I noticed that 2.1.3 is the latest freeRADIUS version. Does it work with the above OS & mySQL versions or I need to fall back to a previous version of freeRADIUS? I am pretty new and this is my first freeRADIUS installation! Sam

2 1

Does FreeRADIUS support PEAPv0/EAP-TLS?
by Jason Wittlin-Cohen 10 Dec '08

10 Dec '08

I'm attempting to setup PEAPv0/EAP-TLS which uses EAP-TLS as the inner authentication method within PEAP. Unlike EAP-TLS, PEAPv0/EAP-TLS sends the client certificate within the secure SSL tunnel, thus protecting the user's identity. While RFC-5216 suggests that EAP-TLS can optionally support a privacy mode in which the client certificate is pushed through the SSL tunnel, I've not found any way to enable this option. I have no particual interest in using PEAPv0/EAP-TLS other than the fact that I know it does what I want to accomplish. I would be perfectly happy to use EAP-TLS in Privacy mode, or PEAPv0/MSCHAPv2 with a required client certificate. However, both these modes pass the client certificate in the clear. Here's what my testing has shown: EAP-TLS: Works with both Windows XP Supplicant and Juniper Odyssey Access Client 4.8 PEAPv0/EAP-MSCHAPv2- Works with both Windows XP Supplicant and Juniper Odyssey Access Client 4.8 PEAPv0/EAP-MSCHAPv2 + Requierd Client Certificate- Works with Juniper Odyssey Access Client 4.8 (XP Supplicant doesn't support MSCHAPv2 + Certificate) PEAPv0/EAP-TLS- Fails on both supplicants I don't think my TLS settings are improper, as both EAP-TLS and PEAPv0/MS-CHAPv2 + Client Certifciate work fine. The debug logs shows the client certificate verified properly. I've tried pretty much every combination of PEAP options, and after each permutation I forced a reauthentication so that I could analyze the packets in Wireshark. No combination of settings forced the client certificate through the SSL tunnel. I thought " use_tunneled_reply = yes" might help, but it did not. I have pasted the relevant configuration settings below as well as a full log of the failure when I attempt to use PEAPv0/EAP-TLS. The relevant settings: Other than "default_eap_type = "tls" my settings are identical for PEAPv0/EAP-MSCHAPv2 which works fine. The failure log seems to suggest that "tls" is not a supported authentication mode within PEAP. [files] users: Matched entry DEFAULT at line 200 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} *rlm_eap: No EAP session matching the State variable.* *[eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request* [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [Jason Wittlin-Cohen] (from client Wireless port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 3 [peap] Got tunneled reply RADIUS code 3 [peap] Tunneled authentication was rejected. [peap] FAILURE *PEAPv0/EAP-TLS Failure Log: *http://pastebin.com/m900e269 *PEAPv0/MSCHAPv2 Success Log:* http://pastebin.com/m16114697 *PEAPv.0/MSCHAPv2+Cert Success Log: *http://pastebin.com/m429d9c12 *EAP-TLS Success Log:* http://pastebin.com/m2b1c62f4 Relevant Settings: eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 3072 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server_key.pem" certificate_file = "/etc/freeradius/certs/server_cert.pem" CA_file = "/etc/freeradius/certs/cacert.pem" dh_file = "/etc/freeradius/certs/dh3072.pem" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "HIGH" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no peap { default_eap_type = "tls" copy_request_to_tunnel = no use_tunneled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no modules mschap: Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } Users: "DEFAULT" Cleartext-Password := "**************************************", EAP-TLS-Require-Client-Cert := Yes Note: (*'s represent a 32 character randomly generated password) Thanks in advance, Jason -- Jason Wittlin-Cohen Yale Law School, Class of 2010 jason.wittlin-cohen(a)yale.edu

3 5

Programatically provision users to server.
by Matthew Carriere 10 Dec '08

10 Dec '08

Hi everyone, I am thinking of adding a FreeRadius server to an existing infrastructure in order to provision users through an application. I am currently running a WLAN controller connecting several access points. Currently users are added manually through the WLAN controller interface. Could I add a FreeRadius server and be able to programatically add users to it? I need to be able to do this through a Ruby on Rails application. I am thinking I would have to either: 1. Use some sort of API 2. Run a script that uses a command line interface Your thoughts and suggestions on this architecture would be appreciated. Thanks Matthew.

5 16

Accounting Software
by Just E. Mail 10 Dec '08

10 Dec '08

Hello: My first try on freeRADIUS. I am going to setup a test freeRADIUS server with CentOS 5.2 & mySQL for learning about RADIUS server. Questions: 1. Is there a GUI application to setup freeRADIUS? 2. Is there a free accounting package (must interface with mySQL) I can use? Thanks. Sam

2 1

ldap question
by Craig White 10 Dec '08

10 Dec '08

still a few issues so I upgraded to 2.1.1 and in debug mode (and I have enabled ldap), I see this... [ldap] checking if remote access for $SOME_USER is allowed by uid [ldap] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x... rlm_ldap: sambaLmPassword -> LM-Password == 0x... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user $SOME_USER authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP should I just disable pap? (I can't think of anything that I need to use it for) OR... considering that the LDAP 'userPassword' is essentially the same password that is contained in sambaNTPassword and sambaLMPassword, do I just somehow enable # password_attribute = "userPassword" as it talks about in rlm_ldap doc file? Craig

1 0

RE: No log destination specified.
by Marcel Grandemange 10 Dec '08

10 Dec '08

|->>I have a problem where I upgraded v1 to v2 of freeradius and now I can only |->start it with mode radius -X , if I try use script is simply does following. |-> |-> |-> |->>/usr/local/etc/rc.d]# ./rc.radiusd start |->>Starting FreeRADIUS:radiusd: Error: No log destination specified. |->>Radius |-> |-> |->>Any advise? |-> |->FYI - I have now made a startup script to the following. |-> |->/usr/local/sbin/radiusd -X & > /dev/null 2>&1 |-> |->To Run Freeradius as this is a production machine. >It is complaining that you have not specified a place to write a log file. >====== >logdir = /var/log ># ># The logging messages for the server are appended to the ># tail of this file. ># >log_file = ${logdir}/radius.log >====== >This is from my radiusd.conf file. Radius writes log file messages (few >and far between) to /var/log/radius.log >Fix that and you wont have to use the redirect to /dev/null, which I would >not use anyway as you want log files to know if something is going wrong. This is the beginning of my radius.conf, it seems the entry is indeed there and valid as it's same as old installation. prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd # # The logging messages for the server are appended to the # tail of this file. # log_file = ${logdir}/radius.log >HTH, >Keith

3 2

EAP-SIM
by Leigh Martell 10 Dec '08

10 Dec '08

Hey, This may be a stupid question, but if I don't have access to a carriers HLR. Can I still do EAP-SIM if I have a sim reader. Sorry for this question I am just having trouble finding a definitive answer. Thanks, Leigh

1 0

version 2.1.3 available for Fedora 10 and Fedora 9
by John Dennis 10 Dec '08

10 Dec '08

The new version of FreeRADIUS, 2.1.3, is available in the testing repositories for Fedora 10 and Fedora 9. Please note they are in the testing repositories and have not been pushed to stable yet. If you have questions or issues please consult the FreeRadius Red Hat FAQ (http://wiki.freeradius.org/Red_Hat_FAQ) first. If you have success with it I would appreciate knowing that because that will be the key for me to push it to stable and a wider audience. Comments to this effect can be added to the package release on Bohdi, the Fedora Update System (https://admin.fedoraproject.org/updates) -- John Dennis <jdennis(a)redhat.com>

1 0