April 2008 - Freeradius-Users - lists.freeradius.org

regexp matches are sensitive to position in check items
by Phil Mayers 05 Apr '08

05 Apr '08

Basically, this works in "hints": DEFAULT NAS-Port-Id =~ "(.+):(.+)", NAS-Port !* ANY NAS-Port = `%{expr:1000*%{1} + %{2}}`, Fall-Through = Yes ...but this does not: DEFAULT NAS-Port !* ANY, NAS-Port-Id =~ "(.+):(.+)" NAS-Port = `%{expr:1000*%{1} + %{2}}`, Fall-Through = Yes ...as %{1} and %{2} are undefined in the latter case. I would have expected this to be the opposite case if anything. Is this expected? In 2.0 I would use an "if" unlang, but this is on our (soon to be upgraded) production servers.

2 3

FreeBSD 2.0.3 port closefrom library?
by Chris 05 Apr '08

05 Apr '08

When trying to compile freebsd port of 2.0.3 on 6.3 with the postgresql83 library (also from ports), I get the following: .libs/exec.o(.text+0x536): In function `radius_exec_program': : undefined reference to `closefrom' .libs/session.o(.text+0x4fa): In function `rad_check_ts': : undefined reference to `closefrom' gmake[4]: *** [radiusd] Error 1 I'm not familiar with "closefrom" Which library needs to be included? Thanks.

2 2

EAP-TLS certificate
by xia sihua 05 Apr '08

05 Apr '08

Hi, I am using 2.0.3 version. When I generate certificate using those files ca.cnf, server.cnf, client.cnf xpextensions Makefile which are in the directory ../raddb/certs/. Then I use "make server.vrfy" verify the server certificate, is OK. "make client.vrfy" also ok. I use EAP-TLS authentication Method, and I has modified eap.conf files, and add relative certi file as follows: .... private_key_password = radius private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem .... The supplicant I use TeraDot1x Tester from Spirent communication. ... Configuration: Supplicant ID: test (defined in client.cnf common name) User Certificate Filename: client.pem User Key Filename: client.key Root Certificate Filename: server.pem Key password: test (same defined in client.cnf file) .... When using above configuration, the radius server will print out following error ..... rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept:failed in SSLv3 read client hello B rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. .... If I change Root Certificate Filename from server.pem to ca.pem, will come out following error. .... eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal bad_certificate TLS Alert read:fatal:bad certificate TLS_accept:failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate rlm_eap_tls: SSL_read failed inside of TLS (-1), TLS session fails. .... If I use those certificates provided by spirent, can pass. I donot know why? Any ideas? -- Best regards！ walter *************************************** Nothing is impossible! ***************************************

2 1

WPA Peap problems with Vista (yet again)
by Michael Torrie 05 Apr '08

05 Apr '08

I've read through the list archives about people's problems with Vista and FreeRadius, including the recent messages on this list in January, and a couple of exchanges back in 2006 and 2007. I am running FreeRadius 1.1.7 on a RHEL 4 box, compiled from Fedora 8's FreeRadius SRPM. According to the changelog, the patch/hack to get around Vista's broken SSL fragment handling has been in FreeRadius since 1.1.4, so we're good there. I also read the big warning in the eap.conf file and have ensured that my certificate indeed does have the proper OID that Microsoft requires. The setup (1.1.5 before, and 1.1.7 now) has been working fine for XP SP2 for years. Yet I still have the problem where after the Access-Challenge is sent, the Vista clients just silently drop things and the connection fails. This is the behavior that I know I would get if I don't have the required OID in the certificate. Yet it is there! I ran 'openssl x509 -in /path/to/cert.crt -noout -text' and it shows the extended usage as I'd expect. For some reason openssl calls it TLS Web Server Authentication. Thinking that it was still wrong, I did as was suggested on the list in January, and downloaded FreeRadius 2.0.3 and created a self-signed cert with those tools. It looks the exact same, so I know the OID is right. Any ideas? Debug output is: Sending Access-Challenge of id 90 to 192.168.4.10 port 21702 EAP-Message = 0x010800061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xdf09144102cbf146277d93e7d554a782 Finished request 1939 Going to the next request Any ideas on how to better debug and fix this major problem for me? thanks, Michael

2 1

Re: SQL Fall-Through
by snaut＠snaut.ru 05 Apr '08

05 Apr '08

> Hi again, > > > > I want to know what I making wrong. I have an MSSQL database and it's > working great. Now I want to tweak my setup with including some > attribute in group. But it's seems that rlm_sql didn't go see groupcheck > or groupreply. I also put read_groups = yes in mssql.conf Hi! At us similar problems. At me rlm_sql_oracle too does not process the table groupcheck. I hope, developers will correct this bug in freeradius, differently I should leave on 1.1.7. http://lists.freeradius.org/pipermail/freeradius-users/2008-April/070879.ht…

1 0

Auth problem's with Nortel baystack
by FRANCIS PROVENCHER 04 Apr '08

04 Apr '08

Hi all, I'm sorry if i'm double posting (Im not sure if the first message was sent correctly..Sorry if it's the second time you received this message..) When i connect with unix/localuser via telnet on my baystack switch i received message (Access Denied from Radius server) I take a look on log's from radius server and i see this; rad_recv: Access-Request packet from host 192.168.1.210 port 2048, id=13, length=59 NAS-IP-Address = 192.168.1.210 User-Password = "********" Service-Type = Administrative-User User-Name = "francis" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "francis", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "***********" rlm_pap: Using CRYPT encryption. rlm_pap: User authenticated successfully ++[pap] returns ok Login OK: [francis/*********] (from client switch port 0) Sending Access-Accept of id 13 to 192.168.1.210 port 2048 Finished request 0. Going to the next request Waking up in 0.9 seconds. Waking up in 3.9 seconds. Cleaning up request 0 ID 13 with timestamp +970 Ready to process requests. Some one understand what is going wrong with this? Why i cannot log on the switch if the username/password is ok an authenticate? Thanks for your help. Francis Provencher Ministère de la Sécurité publique du Québec Direction des technologies de l'information Division de la sécurité informatique Tél: 1 418 646-3258 BlackBery; 1 418 473 6419 Courriel: Francis.provencher(a)Msp.gouv.qc.ca CEH - Certified Ethical Hackers SSCP - System Security Certified Practitionner Sec+ - Security +

4 4

JRS Case Study - Eduroam & FreeRADIUS 2
by Arran Cudbard-Bell 04 Apr '08

04 Apr '08

Hi All, The University of Sussex recently completed a case study for JANET UK focusing on implementing the eduroam service using FreeRADIUS. It's not quite at the same level as the official eduroam cook book, but should provide FreeRADIUS 2 users wishing to implement eduroam (visited / home) service a starting point. Comments, suggestions and corrections welcome. http://www.ja.net/documents/services/janet-roaming/sussex-freeradius-case-s… I'll also be around at Networkshop 36, so hope to see some of you there :) (I apologise for the diagrams, something weird in the PDF conversion process, trying to get it fixed...) Best Regards, Arran L Cudbard-Bell -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

2 1

SQL Fall-Through
by Guillaume Chartrand 04 Apr '08

04 Apr '08

Hi again, I want to know what I making wrong. I have an MSSQL database and it's working great. Now I want to tweak my setup with including some attribute in group. But it's seems that rlm_sql didn't go see groupcheck or groupreply. I also put read_groups = yes in mssql.conf Here is my database and debut output usergroup 1,"guillaume","dynamic" 2,"jacques","dynamic" Radcheck 1,"guillaume","Cleartext-Password","xxxxxx",":=" 2,"jacques","Cleartext-Password","xxxxx",":=" Radreply 5, ,"guillaume","Fall-Through","Yes","=" Radgroupcheck 2,"dynamic","Expiration","""4 april 2008""",":=" Radgroupreply 1,"dynamic","Framed-Compression","Van-Jacobsen-TCP-IP",":=",0 2,"dynamic","Framed-Protocol","PPP",":=",0 3,"dynamic","Service-Type","Framed-User",":=",0 4,"dynamic","Framed-MTU","1500",":=",0 rad_recv: Access-Request packet from host 172.20.50.202 port 1088, id=49, length=249 Message-Authenticator = 0xacf874dd95a5e7a44477ebe85628c2d2 Service-Type = Framed-User User-Name = "guillaume\000" Framed-MTU = 1488 State = 0x937fe8889b4ef1e0c024c3839183ef26 Called-Station-Id = "00-0F-3D-AB-1C-07:testGuillaume" Calling-Station-Id = "00-0E-35-99-F3-E9" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x023100261900170301001b37f64ad3eba1ecf9db603f2431312964a27e49ca72e0f0d1 588d99 NAS-IP-Address = 172.20.50.202 NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize ++[preprocess] returns ok expand: %{User-Name} -> guillaume rlm_sql (sql): sql_set_user escaped user --> 'guillaume' rlm_sql (sql): Reserving sql socket id: 2 expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'guillaume' ORDER BY id query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'guillaume' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'guillaume' ORDER BY id query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'guillaume' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++? if (ok) ? Evaluating "ok" -> TRUE ++? if (ok) -> TRUE ++- entering if (ok) +++[control] returns ok ++- if (ok) returns ok rlm_eap: EAP packet type response id 49 length 38 rlm_eap: Continuing tunnel setup. ++[eap] returns ok ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Success rlm_eap: Freeing handler ++[eap] returns ok Sending Access-Accept of id 49 to 172.20.50.202 port 1088 MS-MPPE-Recv-Key = 0xc65d46cf1ee515a044585d7158c6c0dd39d183728c7541316f1171f701729069 MS-MPPE-Send-Key = 0x338d0bb6e1edd84602c3795eb3dc12da8e04b1b85dd988013a7e621e3f40399a EAP-Message = 0x03310004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "guillaume" Finished request 9. Going to the next request Thank ---------------------------- Guillaume Chartrand

1 0

Re: Users cant connect Freeradius 2.0.2
by Gustavo Chavelas 04 Apr '08

04 Apr '08

Hi. I have to take the /certs/*.* from old version and put this in new version, but, I have same problem. I have made all. For example, I have copied the radius.conf and eap.conf, and clients.conf, and users from old version to new version, but I have the same problem. My clients can't connect. It's very bad for me why I need to connect WindowsXP, Windows Vista and Windows CE. Some suggest pls?

1 0

Unknown value ntlm_auth for attribute Auth-Type
by Charles Jones 04 Apr '08

04 Apr '08

Hello again, First off, thanks go to all who provided the excellent documentation available on the FR wiki, and affiliated sites. Because of that documentation, I have FR 2.0.3 installed on CentOS 5.1, and it is working rather nicely for Cisco port-based 802.1x authentication via Active Directory (2k3 server). I have now configured LDAP-based Group authorization for Cisco privileged access to the routers/switches in our network. I have the authorization side working great, but I've run into a problem trying to get AD authorization to work: Passwords are not checked at all. Authentication is not happening through FR for these logins. As long as a valid user account from AD is supplied, and as long as that user is in the proper group, ("Network Managers" or "Switch Access") instant shell access is granted regardless of the password supplied, and they are immediately dropped into the designated privilege level for that group. I presume the immediate cause of this problem is the "Auth-Type := Accept" in my users file. My first instinct (after reading *tons* of mailing lists and forum posts) was to simply remove the Auth-Type attribute, and see if FR would find a way. Unfortunately, I receive an error stating "No authenticate method (Auth-Type) configuration found for the request", and the request is rejected. Next, I decided to try a different Auth-Type. However, anytime I try to provide an alternative Auth-Type, FR refuses to start with "Unknown value for <insert Auth-Type of choice here> for attribute Auth-Type". I have specifically tried to use ntlm_auth because that would be my preferred method of authentication between FR and AD. When I attempted to use ntlm_auth as the Auth-Type, I received the "Unknown Value" message. I also tried adding an entry for it in the sites_available/default file under the "authorize" section to see if that helped. I received the same error. Next, I tried adding it to the "instantiate" section just out of curiosity, and received a new error stating "Cannot find a configuration entry for module ntlm_auth". Am I even moving in the right direction with this? I know there are people out there who must be using a configuration similar to this setup. I have attached all of the relevant configuration files, cisco configs, and debug logs from my test lab for your review. *edit* The files take me 12K over the 100K size limit for a posting, so I will send the debug logs in a reply to this post. I will gladly accept any assistance, advice, known working configs, or suggestions you may have regarding this issue. And if I've just royally screwed something up, I'd like to know that too. Heck, if you see *anything* that doesn't make sense in my configuration setup, please feel free to bring it to my attention. Thanks in advance, Charles Jones

2 7