May 2008 - Freeradius-Users - lists.freeradius.org

EAP TLS testing using eapol_test
by Naunidh S Chadha 21 May '08

21 May '08

Hi All I am attempting to authenticate an EAP-TLS using eapol_test tool against FreeRADIUS Version 2.0.3. >From last two days I am getting stumped by certificate issues. Currently I have the following error in my Freeradius log that seems to be the problem. Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: Done initial handshake Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: <<< TLS 1.0 Handshake [length 038d], Certificate Wed May 21 19:31:19 2008 : *Error: --> verify error:num=20:unable to get local issuer certificate* Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca Wed May 21 19:31:19 2008 : Error: TLS Alert write:fatal:unknown CA Wed May 21 19:31:19 2008 : Error: TLS_accept:error in SSLv3 read client certificate B Wed May 21 19:31:19 2008 : Error: rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned Wed May 21 19:31:19 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Wed May 21 19:31:19 2008 : Debug: eaptls_process returned 13 >From searching around the net I found that one issue could be that my SSL does not understand that server.pem is a trusted CA. To make that happen I created hashes using the following command, *ln -s client.pem `openssl x509 -hash -noout 5~-in client.pem`.0* for ca.pem/server.pem and client.pem. I then pasted the hashes and .pem files into /usr/share/ssl/certs folder too (out of desperation :) ). After this if I ran the command "openssl verify *.pem" in .../raddb/certs folder, it would return OK for all pem files. IMO this is the best to test that all certificates are in order. I also used the command "openssl verify -CApath . *.pem" (picked it up from Makefile) and it returned OK too. I must add here that my setup is totally as per the docs/config file explanations. The radiusd.conf is configured to use EAP as per the default config, and the certs are made by running the make command in raddb/certs folder. I commented out bootstrap for my exploration. I ran "make client.pem" to create client certificates. The supplicant client uses following configuration file: network={ ssid="1x-test" key_mgmt=WPA-EAP eap=TLS identity="user(a)example.com" ca_cert="/usr/local/etc/raddb/certs/ca.pem" client_cert="/usr/local/etc/raddb/certs/user(a)example.com.pem" private_key="/usr/local/etc/raddb/certs/client.key" private_key_passwd="whatever" eapol_flags=3 } Since the logs are big enough to be a torture for people reading in digest mode, I have put them at http://naunidh.googlepages.com/logs It has output of radiusd -XXX followed by logs of eapol_test tool. My OpenSSL version is 9.7a (supported by Freeradius), My next step would be to upgrade this but it does not look like an OpenSSL issue, Upgrading this would be a pain at the moment as lot of people are dependent on the setup, but this is the only recourse left from my side. Any help would be greatly appreciated. Sorry for the long mail, but I could not shorten it any more without missing something important. Thanks All - Naunidh

1 0

Trouble with missing CiscoNASPort
by Kai Arne Bjørnenak 21 May '08

21 May '08

Hello We run Freeradius 1.1.7 against a postgresql-database, and for some auth-sessions Cisco NAS Port does not get stored in the database. I have checked the freeradius detail-logs to see that the server really has these values, so I'm a bit stumped as to why this happens. The SQL-queries have been slightly modified to fit our use, so I'm including the relevant ones here from postgresql.conf. accounting_update_query = "UPDATE ${acct_table1} \ SET FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, \ AcctSessionTime = (EXTRACT(EPOCH FROM(now()::timestamp with time zone - AcctStartTime::timestamp with time zone - '%{Acct-Delay-Time:-0}'::interval)))::BIGINT, \ AcctInputOctets = (('%{Acct-Input-Gigawords:-0}'::bigint << 32) + '%{Acct-Input-Octets:-0}'::bigint), \ AcctOutputOctets = (('%{Acct-Output-Gigawords:-0}'::bigint << 32) + '%{Acct-Output-Octets:-0}'::bigint) \ WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}' AND UserName = '%{SQL-User-Name}' \ AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStopTime IS NULL" accounting_update_query_alt = "INSERT into ${acct_table1} \ (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortType, CiscoNASPort, AcctStartTime, \ AcctSessionTime, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, \ FramedProtocol, FramedIPAddress) \ values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', \ '%{NAS-Port-Type}', NULLIF('%{Cisco-NAS-Port}', ''), (now() - '%{Acct-Delay-Time:-0}'::interval - '%{Acct-Session-Time:-0}'::interval), \ NULLIF('%{Acct-Session-Time}','')::bigint, \ (('%{Acct-Input-Gigawords:-0}'::bigint << 32) + '%{Acct-Input-Octets:-0}'::bigint), \ (('%{Acct-Output-Gigawords:-0}'::bigint << 32) + '%{Acct-Output-Octets:-0}'::bigint), '%{Called-Station-Id}', \ '%{Calling-Station-Id}', '%{Framed-Protocol}', \ NULLIF('%{Framed-IP-Address}', '')::inet)" accounting_start_query = "INSERT into ${acct_table1} \ (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortType, CiscoNASPort, AcctStartTime, \ CalledStationId, CallingStationId, FramedProtocol, FramedIPAddress, AcctStartDelay) \ values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', \ '%{NAS-Port-Type}', NULLIF('%{Cisco-NAS-Port}', ''), (now() - '%{Acct-Delay-Time:-0}'::interval), \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Framed-Protocol}', \ NULLIF('%{Framed-IP-Address}', '')::inet, '%{Acct-Delay-Time:-0}') " accounting_start_query_alt = "UPDATE ${acct_table1} \ SET AcctStartTime = (now() - '%{Acct-Delay-Time:-0}'::interval), \ WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}' AND UserName = '%{SQL-User-Name}' \ AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime IS NULL" If I could get any pointers as to what could be wrong or ways to debug this I would be very grateful. Regards Kai Bjørnenak

1 0

Dynamic VLAN and FreeRadius
by William E. Russell 21 May '08

21 May '08

All, I am trying to get the RADIUS server to not only authenticating the supplicant, but providing the NAS with a VLAN ID. I have tried certain resources and haven't been able to receive the VLAN ID. Can any provide any help in this area? Thanks William E. W. Russell Member of Technical Staff (Software Development) 198 Brighton Avenue Long Branch, New Jersey 07740 Home #: 732-752-2037 Cell #: 732-744-6483

3 2

mod_auth_radius: AuthRadiusCookieValid problem
by richard lucassen 20 May '08

20 May '08

Hello list, I use the mod_auth_radius module in both Apache1 and Apache2. These modules work fine, but a remarkable difference between the two is that the variable "AuthRadiusCookieValid" (which is set to "1", which means one minute) is working well when the Apache1 is visited, but is not working at all when viewing a page on Apache2. I realize that this issue may not be related to freeradius, but does anyone have a hint? R. -- ___________________________________________________________________ It is better to remain silent and be thought a fool, than to speak aloud and remove all doubt. +------------------------------------------------------------------+ | Richard Lucassen, Utrecht | | Public key and email address: | | http://www.lucassen.org/mail-pubkey.html | +------------------------------------------------------------------+

1 0

Re: Java client for Radius
by avihai marchiano 20 May '08

20 May '08

Do you know if its also support other vendors? I understand (and i might understand wrong) that you need to configure (or install) something in the server side in order to work with JRadius. I need to work against all Radius servers and i cant change or add to the Raidus server. ----- Original Message ---- From: Guy Davies <aguydavies(a)gmail.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, May 20, 2008 10:35:40 PM Subject: Re: Java client for Radius Hi Avihai, I use the client that comes with the jradius server on my Mac and it's great. I don't use a particularly wide range of the features, I'm sure I barely scratch the surface, if I'm honest, but it does what I need (and it works flawlessly on my Mac :-) I've not tried radius-client so I cannot make a comparison. Rgds, Guy 2008/5/20 avihai marchiano <avihaimar(a)yahoo.com>: > Hey, > > I need a java client for Radius. it need to work with all vendors. > I saw two open sources: JRadius, radius-client. > Does someone compare them? > Does someone can recommend? > > Thank you > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Java client for Radius
by avihai marchiano 20 May '08

20 May '08

Hey, I need a java client for Radius. it need to work with all vendors. I saw two open sources: JRadius, radius-client. Does someone compare them? Does someone can recommend? Thank you

2 1

Simple configuration for authoriazation
by avihai marchiano 20 May '08

20 May '08

Hey, I need to have simple Radius server in order to test a Radius client. I want to test authentication and authorization. I add a new user in the user file and test authentication and it work. Now i need to test authorization, where I assign role to this user and how? can someone give me a simple configuration for this? Thank you

1 0

Auth type change when it called through asterisk.
by johnson elangbam 20 May '08

20 May '08

Hi, I successfully done my authentication and authorization with the perl and digest with mix mode, and it reply access accept packets from the radius server. But when i tried to call through asterisk, the server again try to authenticate again and rejected. The auth type is turned into local again though i put perl and digest. How the auth type will be into perl and digest when I called through asterisk. *This is the output log after the server authenticate a user: * rad_recv: Access-Request packet from host 192.168.1.227 port 32958, id=215, length=259 User-Name = "100(a)192.168.1.227" Digest-Attributes = "\n\005100" Digest-Attributes = "\001\017192.168.1.227" Digest-Attributes = "\002*4832e5db308756e206b4536810ea3e70cf300c66" Digest-Attributes = "\004\023sip:192.168.1.227" Digest-Attributes = "\003\nREGISTER" Digest-Response = "805279e87b5ef1a7bc640350165079ff" Service-Type = SIP Sip-URI-User = "100" Cisco-AVPair = "call-id= cceb5fc15db4417d807cbb56871a533d(a)192.168.1.193" NAS-IP-Address = 127.0.0.1 NAS-Port = 5060 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0x98c2a88 asigned new request. Handled so far: 1 found interpetator at address 0x98c2a88 rlm_perl: Added pair Digest-Response = 805279e87b5ef1a7bc640350165079ff rlm_perl: Added pair Service-Type = SIP rlm_perl: Added pair Cisco-AVPair = call-id= cceb5fc15db4417d807cbb56871a533d(a)192.168.1.193 rlm_perl: Added pair User-Name = 100(a)192.168.1.227 rlm_perl: Added pair Sip-URI-User = 100 rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair NAS-Port = 5060 rlm_perl: Added pair Digest-Attributes = \n\005100 rlm_perl: Added pair Digest-Attributes = \001\017192.168.1.227 rlm_perl: Added pair Digest-Attributes = \002*4832e5db308756e206b4536810ea3e70cf300c66 rlm_perl: Added pair Digest-Attributes = \004\023sip:192.168.1.227 rlm_perl: Added pair Digest-Attributes = \003\nREGISTER rlm_perl: Added pair Cleartext-Password = 100 perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x98c2a88 ++[perl] returns ok rlm_digest: Adding Auth-Type = DIGEST ++[digest] returns ok rlm_realm: Looking up realm "192.168.1.227" for User-Name = " 100(a)192.168.1.227" rlm_realm: No such realm "192.168.1.227" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rad_check_password: Found Auth-Type DIGEST auth: type "digest" +- entering group authenticate rlm_digest: Converting Digest-Attributes to something sane... Digest-User-Name = "100" Digest-Realm = "192.168.1.227" Digest-Nonce = "4832e5db308756e206b4536810ea3e70cf300c66" Digest-URI = "sip:192.168.1.227" Digest-Method = "REGISTER" A1 = 100:192.168.1.227:100 A2 = REGISTER:sip:192.168.1.227 H(A1) = fc0ea6eaea4a4b50ad280e803f4bd6a2 H(A2) = fbf27b090821dd0f71c0a0dda09e5e8e KD = fc0ea6eaea4a4b50ad280e803f4bd6a2:4832e5db308756e206b4536810ea3e70cf300c66:fbf27b090821dd0f71c0a0dda09e5e8e EXPECTED 805279e87b5ef1a7bc640350165079ff RECEIVED 805279e87b5ef1a7bc640350165079ff ++[digest] returns ok Login OK: [100(a)192.168.1.227/<via Auth-Type = DIGEST>] (from client 192.168.1.227 port 5060) +- entering group post-auth perl_pool: item 0x9997960 asigned new request. Handled so far: 1 found interpetator at address 0x9997960 rlm_perl: Added pair Digest-User-Name = 100 rlm_perl: Added pair Digest-Response = 805279e87b5ef1a7bc640350165079ff rlm_perl: Added pair Service-Type = SIP rlm_perl: Added pair Digest-URI = sip:192.168.1.227 rlm_perl: Added pair Digest-Realm = 192.168.1.227 rlm_perl: Added pair Cisco-AVPair = call-id= cceb5fc15db4417d807cbb56871a533d(a)192.168.1.193 rlm_perl: Added pair Digest-Method = REGISTER rlm_perl: Added pair User-Name = 100(a)192.168.1.227 rlm_perl: Added pair Sip-URI-User = 100 rlm_perl: Added pair Digest-Nonce = 4832e5db308756e206b4536810ea3e70cf300c66 rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair NAS-Port = 5060 rlm_perl: Added pair Digest-Attributes = \n\005100 rlm_perl: Added pair Digest-Attributes = \001\017192.168.1.227 rlm_perl: Added pair Digest-Attributes = \002*4832e5db308756e206b4536810ea3e70cf300c66 rlm_perl: Added pair Digest-Attributes = \004\023sip:192.168.1.227 rlm_perl: Added pair Digest-Attributes = \003\nREGISTER rlm_perl: Added pair Cleartext-Password = 100 rlm_perl: Added pair Auth-Type = digest perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x9997960 ++[perl] returns ok Sending Access-Accept of id 215 to 192.168.1.227 port 32958 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 214 with timestamp +5 Cleaning up request 1 ID 215 with timestamp +5 Ready to process requests. *This is the output log after the server reject a user when it is call through asterisk *rad_recv: Access-Request packet from host 192.168.1.227 port 33036, id=222, length=104 Called-Station-Id = "200" Calling-Station-Id = "100" User-Name = "100" User-Password = "\034]W\242\237\233\312s6\210Sx\241\345pl" NAS-Identifier = "Asterisk" h323-conf-id = "1211297773.35" NAS-IP-Address = 192.168.1.227 NAS-Port = 5071 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0x9cc2358 asigned new request. Handled so far: 1 found interpetator at address 0x9cc2358 rlm_perl: Added pair Calling-Station-Id = 100 rlm_perl: Added pair Called-Station-Id = 200 rlm_perl: Added pair User-Name = 100 rlm_perl: Added pair User-Password = \034]W\242\237\233\312s6\210Sx\241\345pl rlm_perl: Added pair NAS-Identifier = Asterisk rlm_perl: Added pair h323-conf-id = 1211297773.35 rlm_perl: Added pair NAS-IP-Address = 192.168.1.227 rlm_perl: Added pair NAS-Port = 5071 rlm_perl: Added pair Cleartext-Password = 100 perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x9cc2358 ++[perl] returns ok ++[digest] returns noop rlm_realm: No '@' in User-Name = "100", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Login incorrect: [100/\034]W\242\237\233\312s6\210Sx\241\345pl] (from client 192.168.1.227 port 5071 cli 100) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> 100 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 222 to 192.168.1.227 port 33036 Waking up in 4.9 seconds. Cleaning up request 2 ID 222 with timestamp +768 Ready to process requests. with regards, Elangbam Johnson

1 0

Testing FreeRaduis
by youness hsina 20 May '08

20 May '08

Hi all sorry for my english. i'm running a freeradius server on FreeBSD and i wanted to test it but it doesn't work and i don't know why. i have tried this command : *radtest yhsina yhsina @IPserver 1 testing123. * *yhsina* is a user who is located in a LDAP server. it give me this thing : radclient: no reponse from server for ID 107 have any idea please thank for your help in advance. Uness

2 11

mysql isn't match with online users status
by Zahra Bahar 20 May '08

20 May '08

we have freeradius for accounting of dialup and vpn users. sometimes users have been stoped but they are online in mysql table . what's wrong? is there any log of commmands exchange between freeardius and mysql?

4 6