February 2008 - Freeradius-Users - lists.freeradius.org

EAP/TTLS on LDAP with freeradius 2.0.1
by Thierry CHICH 07 Feb '08

07 Feb '08

Hello, I know that my problem is so simple that I should be ashamed to ask help, but I have to say that I can't find a good way to do what I want to do. With the previous release of freeradius 1.1.7, I could do the following things: - people with a correct outer identity and inner identity (login/password) could be authorized and authenticate on a LDAP server, using an EAP-TTLS tunnel, obtained a WPA key. - with the same radius server, I could authenticate people with EAP-PEAP and mschapv2 on a sql database. It was nice, but I had a small problem: accounting was done using the outer identity. Since I was using the ldap to do the authorization, people who put an other valid identity didn't be correctly accounted. Then, I decided to use freeradius 2.0.1. And then I don't see how to obtain a basic configuration that is doing my first point. I always finished by : rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user If I put an Auth-Type := LDAP, it seems better in the first time, but it is worst: rad_check_password: Found Auth-Type LDAP auth: type "LDAP" +- entering group LDAP rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. You seem to have set "Auth-Type := LDAP" somewhere. THAT CONFIGURATION IS WRONG. DELETE IT. YOU ARE PREVENTING THE SERVER FROM WORKING PROPERLY. ++[ldap] returns invalid auth: Failed to validate the user. At this point, I don't understand what freeradius want. I don't know how to say : authorize on waht you want, I don't care, and authenticate on my LDAP server. Is it a good configuration sample I can find anywhere ? Regards, -- Thierry CHICH

3 7

password failover
by jonr＠destar.net 07 Feb '08

07 Feb '08

Hello, How do I set up a freeradius server so that if the password fails for the primary radius server it tries the secondary for the password. In my scenario, the primary is up and servicing requests, but the password for the device is incorrect. Now the device looks to the secondary to get authorized and the secondary holds the correct secret for the device. I have looked at fail-over and load-balancing but am not sure if either of these are what I am looking for. Can someone tell me what I am looking for and I can do the rest. Thanks for any help, Jon

4 9

freeradius doesn't start at boot-time : mysql error
by mailinglists 07 Feb '08

07 Feb '08

Hello, I use freeradius-1.1.3-1.2.el5 and freeradius-mysql-1.1.3-1.2.el5. the mysql database (mysql-server-5.0.22-2.1.0.1) is hosted on a remote host (both centos5). When I use /etc/init.d/radiusd as root it starts up correctly. But when the service is launched at boot time, I get this error-log : Wed Feb 6 16:17:46 2008 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Feb 6 16:17:46 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Feb 6 16:17:46 2008 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Wed Feb 6 16:17:46 2008 : Info: rlm_sql (sql): Attempting to connect to radius@192.168.1.1:/radius Wed Feb 6 16:17:46 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Wed Feb 6 16:17:49 2008 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server radius@192.168.1.1:radius Wed Feb 6 16:17:49 2008 : Error: rlm_sql_mysql: Mysql error 'Can't connect to MySQL server on '192.168.1.1' (113)' Wed Feb 6 16:17:49 2008 : Error: rlm_sql (sql): Failed to connect DB handle #0 Wed Feb 6 16:17:49 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0 Wed Feb 6 16:17:49 2008 : Error: rlm_sql (sql): generate_sql_clients() returned error Wed Feb 6 16:17:49 2008 : Error: radiusd.conf[14]: sql: Module instantiation failed. Wed Feb 6 16:17:49 2008 : Error: radiusd.conf[1844] Unknown module "sql". Wed Feb 6 16:17:49 2008 : Error: radiusd.conf[1773] Failed to parse authorize section. I look at tcpdump on the mysql-server host, and during the boot of my freeradius server, I see no traffic comming from freeradius host. There is no reject in the firewall. I've tried to put the radius rc.d script in S99 to start it as late as possible, but nothing changes. I also noticed that it doesen't seem to retry to connect to the database later. Or is it after a long time ? Is this a bug ? Where is the retry time configured (I cant try to set up to 5 seconds) ? Thanks for answers Laetitia.

1 0

weird error
by Joe Vieira 07 Feb '08

07 Feb '08

Wed Feb 6 10:43:44 2008 : Error: TLS Alert write:fatal:bad record mac Wed Feb 6 10:43:44 2008 : Error: rlm_eap: SSL error error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac Wed Feb 6 10:43:44 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. could someone help me figure out what that means exactly? thanks, -- Joe Vieira UNIX Systems Administrator Clark University - ITS

3 4

Proxying VMPS requests
by Phil Mayers 06 Feb '08

06 Feb '08

I'm looking at using FreeRadius 2.0.1 to merge out old VMPS switches into the radius-based (SQL-backed) MAC auth. For various reasons, the easiest thing for me would be to proxy the VMPS requests as PAP to our existing mac auth servers. The comments in raddb/sites-available/vmps imply that the packets can be proxied, but I'm not seeing that: # VMPS server server vmps { listen { # FIXME: should be .202 for production ipaddr = 192.168.x.y port = 1589 type = vmps } # And the REAL contents. This section is just like the # "post-auth" section of radiusd.conf. In fact, it calls the # "post-auth" component of the modules that are listed here. # But it's called "vmps" to highlight that it's for VMPS. vmps { # we cheat, and proxy to the MACAUTH radius servers update control { Proxy-To-Realm := "MACAUTH" } } post-proxy { # FIXME: log to sql_log actually detail } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on vmps address 155.198.63.122 port 1589 as server vmps Ready to process requests. VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 234881024 VMPS-Client-IP-Address = 155.198.51.130 VMPS-Port-Name = "4 " VMPS-VLAN-Name = "--NONE--" VMPS-Domain-Name = "HOR-PG" VMPS-Unknown = 0x00 VMPS-MAC = 00:1b:24:a1:cf:2e server vmps { Doing VMPS Done VMPS } # server vmps Failed encoding packet: Failed to find VQP-Packet-Type in response packet Finished request 0. Going to the next request Waking up in 0.9 seconds. Waking up in 3.9 seconds. Cleaning up request 0 ID 234881024 with timestamp +1 Ready to process requests. Looking at the source code, it seems the vmps code only runs the post-auth section and doesn't check any control variables, so Proxy-To-Realm is unlikely to work. If this is intentional, could we remove the comments about proxying and pre/post proxy from sites-available/vmps? Is there any reason the code doesn't run: authorize then either post-auth or pre-proxy post-proxy post-auth ?

3 3

need help in using mySql for freeRadius server.
by johnson elangbam 06 Feb '08

06 Feb '08

hi, I am a new user in free radius with mysql, i've configure all the necessary .config files (viz., sql.conf and radiusd.conf) of the free radius for connecting to the mysql, but i wouldn't be able to connect to mysql database. Please tell me how to check that my free radius server is already connected to mysql and when i used the Unix username and password it receives access-accept packets. I've tried http://wiki.freeradius.org/SQL_HOWTO also but the instructions given there is slightly different from the one I am using. I am using free radius 2.0.0. Please help me in configuring this to connect to mysql. with regards Elangbam Johnson

3 3

need help in using mySql for freeRadius server.
by johnson elangbam 06 Feb '08

06 Feb '08

hi, I am a new user in free radius with mysql, i've configure all the necessary .config files (viz., sql.conf and radiusd.conf) of the free radius for connecting to the mysql, but i wouldn't be able to connect to mysql database. Please tell me how to check that my free radius server is already connected to mysql and when i used the Unix username and password it receives access-accept packets. I've tried http://wiki.freeradius.org/SQL_HOWTO also but the instructions given there is slightly different from the one I am using. I am using free radius 2.0.0. Please help me in configuring this to connect to mysql. Debug of the server startup display like this [root@adore etc]# radiusd -X FreeRADIUS Version 2.0.0, for host i686-pc-linux-gnu, built on Jan 29 2008 at 12:25:11 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/sql/mysql/counter.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { syslog_facility = "daemon" stripped_names = no file = "/usr/local/var/log/radius/radius.log" auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "johnson123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "johnson123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "NULL" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP- Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response " key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests.

1 0

need help in using mySql for freeRadius server.
by johnson elangbam 06 Feb '08

06 Feb '08

hi, I am a new user in free radius with mysql, i've configure all the necessary .config files (viz., sql.conf and radiusd.conf) of the free radius for connecting to the mysql, but i wouldn't be able to connect to mysql database. Please tell me how to check that my free radius server is already connected to mysql and when i used the Unix username and password it receives access-accept packets. I've tried http://wiki.freeradius.org/SQL_HOWTO also but the instructions given there is slightly different from the one I am using. I am using free radius 2.0.0. Please help me in configuring this to connect to mysql. the debug log display like this Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 32771, id=218, length=56 User-Name = "john" User-Password = "radpass" NAS-IP-Address = 192.168.1.227 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns updated rlm_realm: No '@' in User-Name = "john", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "radpass" rlm_pap: Using CRYPT encryption. rlm_pap: Passwords don't match ++[pap] returns reject auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> john attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 218 to 127.0.0.1 port 32771 Waking up in 4.9 seconds. Cleaning up request 0 ID 218 with timestamp +34 Ready to process requests. with regards Elangbam Johnson

3 2

ip pool problem
by Luis Galan 06 Feb '08

06 Feb '08

Hi! I am using freeradius 1.1.3 and I have some problems with dial-up users using a dynamic pool of ip adresses. When user A are logged in with ip address 1, its ip is marked as used in the pool only for 2/3 minutes. After that if an user B logs in, then this new user can received the same ip address that user A was using. Could it be a problem from the NAS params sent to radius? What attributes are used to control the pool assignment? Could someone help me? . . . ippool poolJazDialup { range-start = 1.1.1.129 range-stop = 1.1.1.254 netmask = 255.255.255.255 cache-size = 126 session-db = ${raddbdir}/db.ippool.poolDialup ip-index = ${raddbdir}/db.ipindex.poolDialup override = no maximum-timeout = 0 } . . . accounting { detail poolJazDialup group { sql1 { fail = 1 notfound = return noop = 2 ok = return updated = 3 reject = return userlock = 4 invalid = 5 handled = 6 } sql2 { fail = 1 notfound = return noop = 2 ok = return updated = 3 reject = return userlock = 4 invalid = 5 handled = 6 } } } post-auth { # Get an address from the IP Pool. poolJazDialup reply_log group { sql1 { fail = 1 notfound = return noop = 2 ok = return updated = 3 reject = return userlock = 4 invalid = 5 handled = 6 } sql2 { fail = 1 notfound = return noop = 2 ok = return updated = 3 reject = return userlock = 4 invalid = 5 handled = 6 } } Post-Auth-Type REJECT { group { sql1 { fail = 1 notfound = return noop = 2 ok = return updated = 3 reject = return userlock = 4 invalid = 5 handled = 6 } sql2 { fail = 1 notfound = return noop = 2 ok = return updated = 3 reject = return userlock = 4 invalid = 5 handled = 6 } } } }

2 2

help required
by sanjeev.kumarroy＠wipro.com 06 Feb '08

06 Feb '08

Hi, I am completely new to using freeradius 1.1.7. Can you please give me an insight to how we can test MSCHAP V2 using this? Thanks Please do not print this email unless it is absolutely necessary. Spread environmental awareness. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 1