April 2008 - Freeradius-Users - lists.freeradius.org

I have been struggling to get the EAP-TTLS to work.
by Johan Nyman 10 Apr '08

10 Apr '08

Hello all, I have been struggling to get the EAP-TTLS to work. I have been following this guide: <http://rbirri.9online.fr/howto/Freeradius_+_TTLS.html> http://rbirri.9online.fr/howto/Freeradius_+_TTLS.html And i think the setup of all things has gone fine (biggest problem i had was creating the certifcates). I have tested the connection with "raddtest" and the tool "NTRadPing" and everything seems ok. However when i try to connect from my Linux machine using WPA supplicant, the following errors appear in the Radius server console: ............................................................................ ....... Going to the next request Waking up in 4.9 seconds. User-Name = "johan(a)mediavisiongroup.se" NAS-IP-Address = 192.168.1.144 Called-Station-Id = "00-20-a6-64-c3-b1:MVG-Personal" Calling-Station-Id = "00-0f-cb-f9-3b-f9;MVG-Personal" NAS-Identifier = "MVG-1" State = 0xdea187e5dea3836d25979821eb25f055 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060315 Message-Authenticator = 0x80154e870b93b69627ead5a0eee17643 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: Looking up realm "mediavisiongroup.se" for User-Name = "johan@med iavisiongroup.se" rlm_realm: No such realm "mediavisiongroup.se" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/ttls rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xdea187e5dfa2926d25979821eb25f055 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 48 with timestamp +3 Cleaning up request 1 ID 49 with timestamp +3 Ready to process requests. ............................................................................ ....... The connection conf from the Linux box is (/etc/wpa_supplicant.conf): network={ ssid="MVG-Personal" scan_ssid=1 key_mgmt=WPA-EAP eap=TTLS identity="johan(a)mediavisiongroup.se" anonymous_identity="anonymous(a)example.com" password="foobar" ca_cert="/etc/cert/ca.pem" phase2="auth=MD5" } - I am guessing that the /etc/cert/ca.pem is the "client certification" i created from the freeradius. - User and password above (in the file /etc/wpa_supplicant.conf) do exist and is correct. They match the user and password in the file on the freeradius "/usr/local/etc/raddb/users". ............................................................................ ....... Also so i understand this, three certficates are needed for EAP-TTLS ? CA= root certifcate stored on the freeradius machine Server = certifcate also stored on the freeradius machine Client = certifcate copied to the client trying to connect And on the client the path in the "wpa_supplicant.conf" to the client certificate is correct. In short: the client seem to connect to the freeradius, but i am getting no IP to the client. ............................................................................ ....... Thanks very much for help! Best regards, Johan

3 2

windows cisco radius opendlap
by alois blasbichler 10 Apr '08

10 Apr '08

Hello list I am trying to let authenticate my users with radius/ldap before he can enter with hers windows-xp-clients my wireles-lan. We use a Cisco wireless lan controller 4400. We use opendlap for the users attributes : name, password(md5), sambapasswords But i cant get login to my WLAN with an windows-xp-client. Below is the log To explain the log : 10.53.240.10 is my cisco wireless lan controller The mac of my windows-xp-client is : 00-0E-35-5A-86-69 The username i tried is "test". The strange for me is that at the end i see: Login OK: [test] (from client cisco port 29 cli 00-0E-35-5A-86-69) But i see this message also when i use a wrong password Is this a miskonfiguration of my cisco ? I hope somebody can give me a help luis ################################################################### modcall: entering group authorize for request 284 modcall[authorize]: module "preprocess" returns ok for request 284 modcall[authorize]: module "chap" returns noop for request 284 rlm_eap: EAP packet type notification id 32 length 6 rlm_eap: EAP Start not found modcall[authorize]: module "eap" returns updated for request 284 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 284 users: Matched DEFAULT at 162 users: Matched DEFAULT at 181 modcall[authorize]: module "files" returns ok for request 284 modcall[authorize]: module "mschap" returns noop for request 284 rlm_ldap: - authorize rlm_ldap: performing user authorization for test radius_xlat: '(uid=test)' radius_xlat: 'dc=sb-brixen,dc=it' ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=sb-brixen,dc=it, with filter (uid=test) rlm_ldap: checking if remote access for test is allowed by radiusFilterId rlm_ldap: Added password {MD5}z+0c65+jByhDM1ldJwmp9w== in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U & op=21 rlm_ldap: Adding sambaNTPassword as NT-Password, value 54D7A5EF2DC6130A2831D83B84846A87 & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value DB6CF596B290E59AC2265B23734E0DAC & op=21 rlm_ldap: Adding userPassword as User-Password, value { & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFilterId as Filter-Id, value pippoisok & op=11 rlm_ldap: user test authorized to use remote access ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 284 modcall: group authorize returns updated for request 284 rad_check_password: Found Auth-Type EAP auth: type "EAP" modcall: entering group authenticate for request 284 rlm_eap: EAP packet type notification id 32 length 6 rlm_eap: EAP Start not found rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: Unknown EAP type 21, reverting to default_eap_type rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns ok for request 284 modcall: group authenticate returns ok for request 284 Login OK: [test] (from client cisco port 29 cli 00-0E-35-5A-86-69) Sending Access-Challenge of id 121 to 10.53.240.10:32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Filter-Id = "pippoisok" EAP-Message = 0x0121001604108dbc391981d5f73f5291db28b51df479 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0fa7d26d9c7e4f52a6000443ea25ea878bdefd47999b2dd4735b2e46aefd2e0102593e6b Finished request 284 Going to the next request Waking up in 5 seconds... ###################################################################

2 1

Simultaneous use without DB
by Eduardo Lima 10 Apr '08

10 Apr '08

I want to limit one access per user on freeradius 2.0.2 but I don't want to use a database. Is that possible? I red the topic "FreeRadius V2.0.0 Simultaneous-Use Problems" wrote on january, but the author uses mysql. I'm using PEAP authentication with server-side certificate on freeradius 2.0.2. My users file is like this: eduardo Cleartext-Password := "emprel" Auth-Type := System, Simultaneous-Use := 1, Fall-Through = 1 Any idea?? --------------------------------- Abra sua conta no Yahoo! Mail, o único sem limite de espaço para armazenamento!

2 5

Hello,
by Johan Nyman 10 Apr '08

10 Apr '08

Hello all! I am trying to get a wireless client to connect to the Freeradius server using WPA & WPA2 Enterprise . I have followed this guide: http://www.smallnetbuilder.com/content/view/30213/98/1/5/ But I am getting a few error messages from the radius console: 1: ++[mschap] returns noop rlm_realm: No '@' in User-Name = "puppypc", looking up realm NULL rlm_realm: No such realm "NULL 2: rlm_eap: EAP packet type response id 2 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation 3: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because o ++[pap] returns noop I am gussing that any of the above are a hint to what could be the problem, could anyone point me in the right direction here? On where to look/what to change. how to fix. Attaching the entire outtake from the radius console. Thanks for help, Best regards, Johan

1 0

WPA enterprise
by David Hláčik 10 Apr '08

10 Apr '08

Hi i have freeradius mschap ldap working configuration - i am using it for pptpd (VPN server) to authentificate against freeradius with ldap . Windows VPN client can connect to our company network and use it. Next i want to add user/password auth to our WIFI (based on Dlink AP - with radius support). We are currently using wpa-preshared key. i want to use wpa enterprise with ldap authentification (providing username and password) without need to install any certificate on windows. First to make a clear - how do i achieve it? --- i mean exactly which protocol i need to use and how it works (some shortcut to such howto) How do i arrange to use same freeradius for currently working VPN and for my plan to make wpa enterprise. Thanks in advance! David

2 7

WildcardCllients
by Andre Hübner 10 Apr '08

10 Apr '08

Hello List, i use freeradius 0.8.1 coming with my distribution (yes, older system) Is it necessary to declare every single client in clients.conf ? I want to use a "wildcard" client ip 0.0.0.0 to accept every client. This client ip is accepted in clients.conf but connect of real ip is ignored which is logged. I tried with 0.0.0.0/0 but this is errorneous. Is this setup possible or not wanted by developers? I did search the faq and web but did not found related topics. Thank you Andre

2 2

wpa2 - huntgroup problems
by Hans Bornemann 10 Apr '08

10 Apr '08

Hi, I have a problem with huntgroups and wpa2. It concerns the following: First, huntgroups works with ntradping and crypt-passwd: mysql-db unzinn | NT-Password | := | 7C53CFA5EA7D0F9B3B968AA0FB51A3F5 unzinn | crypt-password | == | $1$7ftISFCW$xp.n8LMOxfPD7GqdSJqZC1 unzinn | Huntgroup-Name | == | hrzvpn with wpa2 (PEAP/MSCHAPv2) it works only without the huntgroup entry. Is this a problem because of different adresses? Access-Request packet from host 129.217.169.191 .. NAS-IP-Address = 129.217.157.246 ? huntgroups: hrzvpn NAS-IP-Address == 129.217.157.246 debug: rad_recv: :32769, id=33, length=176 User-Name = "unzinn" Calling-Station-Id = "00-19-D2-CF-E5-50" Called-Station-Id = "00-0B-85-9A-2D-30:ITMC-WPA2" NAS-Port = 29 NAS-IP-Address = 129.217.157.246 NAS-Identifier = "mh-wlc4" Airespace-Wlan-Id = 5 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3503" EAP-Message = 0x0201000b01756e7a696e6e Message-Authenticator = 0x2bf90a315bc202464b3819722bfef98e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 modcall[authorize]: module "chap" returns noop for request 9 modcall[authorize]: module "mschap" returns noop for request 9 rlm_realm: No '@' in User-Name = "unzinn", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 rlm_eap: EAP packet type response id 1 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 radius_xlat: 'unzinn' rlm_sql (sql): sql_set_user escaped user --> 'unzinn' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'unzinn' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'unzinn' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'unzinn' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'unzinn' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 2 rlm_sql (sql): No matching entry in the database for request from user [unzinn] modcall[authorize]: module "sql" returns notfound for request 9 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 9 modcall: leaving group authorize (returns updated) for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" .... Thanks Hans -- Hans Bornemann Universitaet Dortmund - ITMC Tel. ++49 231 755 2132 Fax. ++49 231 755 2731

3 6

eap_tnc.c source not stricly C
by Andrew Hood 10 Apr '08

10 Apr '08

I know good style says newbies should lurk before posting, but anyway: Is freeradius supposed to be C89? src/modules/rlm_eap/types/rlm_eap_tnc/eap_tnc.c Is full of C++ comments and C99isms. -- REALITY.SYS not found: Universe halted.

3 4

unlang to overcome cisco zero tag issue and for dynamic vlan assignment
by bluelip＠gmail.com 10 Apr '08

10 Apr '08

We'd like to setup the following: A workstation is booted, the supplicant asks for the credentials, the cisco switch pa sses the credentials to a freeradius server, freeradius authenticates the user to an edirectory ldap server, freeradius decides which Tunnel-Private-Group-Id to send bac k to the switch to place the user into the correct VLAN. The authentication/authorization works fine. The cisco switch accepts the returned VL AN info if we 'hard code it into the users files such as with: DEFAULT Tunnel-Private-Group-ID:1 := 901 Tunnel-Type:1 = VLAN, Tunnel-Medium-Type:1 = IEEE-802 We attempted to make the configuration more generic by setting Tunnel-Private-Group-I D equal to an LDAP attribute in ldap.attrmap. This would automatically associate the VLAN ID w/ the user. replyItem Tunnel-Private-Group-ID ourldapattribforthevlan That didn't work because freeradius wasn't associating a tag with the attribute(or wa s setting it to zero when responding to the switch. A wireshark capture confirmed the 0 tag. We attempted to add a :1 after Tunnel-Private-Group-ID, but that didn't pan o ut either. We then attempted to use unlang in the users file to accomplish the same thing. (Tunn el-Client-Endpoint was added to ldap.attrmap as dummy variable to hold the 'ourldapat tribforthevlan' from LDAP) DEFAULT Tunnel-Private-Group-ID:1 := `%{reply:Tunnel-Client-Endpoint}`, Tunnel-Type:1 = VLAN, Tunnel-Medium-Type:1 = IEEE-802 With this configuration, we tried countless combinations of backticks, single quotes, and double quotes. The best response we could send back to the switch was: Tunnel-Type:1 = VLAN Tunnel-Medium-Type:1 = IEEE-802 Tunnel-Private-Group-Id:1 = "" Has anyone else come across the issue with Cisco not dealing w/ 0 tags? Is there a wa y to use unlang to pull in the variables to be used in the users file? Thank you for taking the time to read this. After a couple of days of searching, we s till haven't come up w/ the correct search terms for google. Thank you, Mike Coles -- This message was sent on behalf of bluelip(a)gmail.com at openSubscriber.com http://www.opensubscriber.com/messages/freeradius-users@lists.freeradius.or…

2 1

Re: Freeradius 2.0.3 crashing when in proxy mode Segmentation fault.
by Ivan Popov 10 Apr '08

10 Apr '08

Can confirm that, I Use 2.0.3 - snapshort-04072008 I Will try to ask second side to change port of answer from 1646 to 1813 , but dont think that this avoid Segmentation fault. Finished request 797. Cleaning up request 797 ID 92 with timestamp +131 Going to the next request Waking up in 0.3 seconds. Rejecting request 602 due to lack of any response from home server X.X.X.X port 1646 Finished request 602. Cleaning up request 602 ID 152 with timestamp +102 Cleaning up request 602 ID 0 with timestamp +102 Segmentation fault ----- Original Message ---- From: Vikash Badal <Vikash.Badal(a)is.co.za> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, April 10, 2008 10:15:53 AM Subject: Freeradius 2.0.3 crashing when in proxy mode Segmentation fault. Greetings, Can you please assist me with this issue. I set up this server to be the authorative radius server for a realm and no issues were encountered Once I set up the server to proxy, the following issue occured. -------------------------------------------------------- Thu Apr 10 06:49:01 2008 : Debug: Finished request 33. Thu Apr 10 06:49:01 2008 : Debug: Cleaning up request 33 ID 170 with timestamp +451 Thu Apr 10 06:49:01 2008 : Debug: Going to the next request Thu Apr 10 06:49:01 2008 : Debug: Waking up in 4.6 seconds. Thu Apr 10 06:49:06 2008 : Error: Rejecting request 31 due to lack of any response from home server 196.26.56.8 port 1646 Thu Apr 10 06:49:06 2008 : Debug: Finished request 31. Thu Apr 10 06:49:06 2008 : Debug: Cleaning up request 31 ID 169 with timestamp +442 Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x28401100 (LWP 100207)] 0x0806417d in cleanup_delay (ctx=0x287fe110) at event.c:477 477 DEBUG2("Cleaning up request %d ID %d with timestamp +%d", (gdb) bt #0 0x0806417d in cleanup_delay (ctx=0x287fe110) at event.c:477 #1 0x080651ae in wait_a_bit (ctx=0x287fe110) at event.c:947 #2 0x08064dec in post_proxy_fail_handler (request=0x287fe110) at event.c:794 #3 0x08064ea5 in no_response_to_proxied_request (ctx=0x287fe110) at event.c:819 #4 0x280c8a9d in fr_event_run (el=0x287fb000, when=0xbfbfe828) at event.c:214 #5 0x280c9078 in fr_event_loop (el=0x287fb000) at event.c:381 #6 0x080681bd in radius_event_process () at event.c:2675 #7 0x0805d376 in main (argc=2, argv=0xbfbfe928) at radiusd.c:394 (gdb) up #1 0x080651ae in wait_a_bit (ctx=0x287fe110) at event.c:947 947 cleanup_delay(request); (gdb) p/x *request $1 = {packet = 0x0, proxy = 0x0, reply = 0x0, proxy_reply = 0x0, config_items = 0x0, username = 0x0, password = 0x0, root = 0x0, data = 0x0, client = 0x0, child_pid = 0x0, timestamp = 0x47fd9c34, number = 0x1f, listener = 0x28495ac0, proxy_listener = 0x28495af0, simul_max = 0x2, simul_count = 0x0, simul_mpp = 0x0, options = 0x0, module = 0x80734f5, component = 0x80734f5, received = {tv_sec = 0x47fd9c34, tv_usec = 0x45fa}, when = {tv_sec = 0x47fd9c42, tv_usec = 0x6f03}, delay = 0x186a0, master_state = 0x1, child_state = 0x6, priority = 0x3, ev = 0x0, next_when = {tv_sec = 0x47fd9c42, tv_usec = 0x6f03}, next_callback = 0x0, in_request_hash = 0x0, in_proxy_hash = 0x0, home_server = 0x0, home_pool = 0x2848a240, proxy_when = {tv_sec = 0x47fd9c34, tv_usec = 0x6f03}, num_proxied_requests = 0x1, num_proxied_responses = 0x0, server = 0x0, parent = 0x0} (gdb) Vikash Please note: This email and its content are subject to the disclaimer as displayed at the following link http://www.is.co.za/legal/E-mail+Confidentiality+Notice+and+Disclaimer.htm. Should you not have Web access, send a mail to disclaimers(a)is.co.za and a copy will be emailed to you. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1