May 2008 - Freeradius-Users - lists.freeradius.org

howto EAP-TLS on freeradius 2.0.2-3 ??
by Joel MBA OYONE 05 May '08

05 May '08

OK, radiusd -X and /etc/raddb/certs/bootstrap generated some files in /etc/raddb/certs like ca.pem ca.key 01.pem dh index.txt index.txt.attr random serial server.crt srver.key server.p12 server.pem server.csr xpxtensions etc... eap.conf point to the right paths. i intend to authenticate wireless users on xp. i though there was already a certificate and private key for wireless client, but i can see that nowhere. si i think i should create my own certificate and privatekey for client and export install it on windows xp. if i am true and did not forget something to do, my questions are: - is there any problem with the CA private key file and server file extension? (ca.key instead of cakey.pem). - which extension should i use for my windows xp certicate, and please, could you just give me the line! (like openssl req ...., openssl ca - ...-, openssl pkcs12, etc...) sorry for silly questions, but i tried and surely missed something. thank you for helping MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

2 3

Re : Failed to open socket
by Joel MBA OYONE 05 May '08

05 May '08

I had exactly the same message cause i was running radiusd -X via putty on another computer and forgot it. (2.0.2-3). i stop it on putty, then restart radiusd -X on server and everything was ok. maybe you are in the same case. MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 5 Mai 2008, 8h28mn 51s Objet : Re: Failed to open socket Lemaster, Rob wrote: > I recently upgraded to 2.0.4, and now I'm seeing the following error when I start FreeRADIUS: ... > Sat May 3 20:21:39 2008 : Error: ERROR: Failed to open socket: > Sat May 3 20:21:39 2008 : Error: /opt/freeradius-2.0.4/etc/raddb/radiusd.conf[210]: Error binding to port for 0.0.0.0 port 1812 > Sun May 4 01:37:24 2008 : Info: Ready to process requests. So it *does* eventually start. Do you change the configuration between the start attempts? If not, then it's difficult to say why it starts one time, and then not another. Maybe it's port re-use timers? Or something like the FreeBSD Jail issue? Is there a ktrace functionality on your system to see which system calls it's doing, and what the results are? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

1 0

Failed to open socket
by Lemaster, Rob 05 May '08

05 May '08

I recently upgraded to 2.0.4, and now I'm seeing the following error when I start FreeRADIUS: radiusd -X: /opt/freeradius-2.0.4/etc/raddb/radiusd.conf[210]: Error binding to port for 0.0.0.0 port 1812 radius.log: Sat May 3 20:21:39 2008 : Error: ERROR: Failed to open socket: Sat May 3 20:21:39 2008 : Error: /opt/freeradius-2.0.4/etc/raddb/radiusd.conf[210]: Error binding to port for 0.0.0.0 port 1812 Sun May 4 01:37:24 2008 : Info: Ready to process requests. I tried hardcoding the IP & Port in radiusd.conf, but it didn't make any difference. I reviewed posts to this list and found others have seen similar errors, but their fixes didn't apply to my situation. Any suggestinons? Thanks!

2 1

FS trying to authenticate accounting data
by Jim L. 05 May '08

05 May '08

Hello group. I am running FreeRADIUS 2.0.4 and I am attempting to setup a configuration based on the "robust-proxy-accounting" site example. In short, I could not get it to work. To attempt to debug the problem, I pared down the configuration so the only part that was active was the part that it supposed to send the accounting data to a detail file. However, even that small piece does not work. The errors I am getting in the debug logs are auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. However, the configuration to log the data the detail file is only setup for accounting, not authentication. This leaves me confused as to why FS is attempting to do authentication. The relevant parts of the configuration that are active during the test and the debug log is listed below. Any assistance would be appreciated. Thank you, Jim Lohiser ---------- radiusd.conf # Single detail file for accounting failover. detail detail.imaginenet { detailfile = "${radacctdir}/imaginenet/detail-%Y%m%d" } ---------- <site file> # Dummy server to spool accounting data. home_server ImagineNet_Detail { # Added 'type' value to attempt to force accounting only. # Does not fix problem. type = acct virtual_server = ImagineNet_Detail } server ImagineNet_Detail { accounting { detail.imaginenet } } home_server_pool ImagineNet_Acct { type = load-balance home_server = ImagineNet_Detail # Turned this off during to debug. Does not fix problem. #virtual_server = ImagineNet } realm imaginenet.net { auth_pool = ImagineNet_Auth acct_pool = ImagineNet_Acct nostrip } ########## Full Debug rad_recv: Accounting-Request packet from host 192.168.0.10 port 51144, id=81, length=57 User-Name = "jlohiser(a)imaginenet.net" Acct-Status-Type = Start Acct-Session-Id = "9584" +- entering group preacct expand: %{User-Name} -> jlohiser(a)imaginenet.net expand: %{User-Name} -> jlohiser(a)imaginenet.net expand: %{User-Name} -> jlohiser(a)imaginenet.net ++[preprocess] returns ok rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing ',Client-IP-Address = 192.168.0.10,NAS-IP-Address = 192.168.0.10,Acct-Session-Id = "9584",User-Name = "jlohiser(a)imaginenet.net"' rlm_acct_unique: Acct-Unique-Session-ID = "dc24a5ecb36b1652". ++[acct_unique] returns ok rlm_realm: Looking up realm "imaginenet.net" for User-Name = "jlohiser(a)imaginenet.net" rlm_realm: Found realm "imaginenet.net" rlm_realm: Adding Realm = "imaginenet.net" rlm_realm: Proxying request from user jlohiser to realm imaginenet.net rlm_realm: Preparing to proxy accounting request to realm "imaginenet.net" ++[suffix] returns updated ++[files] returns noop +- entering group accounting expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/192.168.0.10/detail-20080502 rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.10/detail-20080502 expand: %t -> Fri May 2 02:33:03 2008 ++[detail] returns ok expand: /var/log/radius/radutmp -> /var/log/radius/radutmp expand: %{User-Name} -> jlohiser(a)imaginenet.net rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! ++[radutmp] returns noop expand: %{User-Name} -> jlohiser(a)imaginenet.net attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated +- entering group pre-proxy preproxy_users: Matched entry DEFAULT at line 35 expand: %{Client-IP-Address} -> 192.168.0.10 ++[files] returns ok >>> Sending proxied request internally to virtual server. server ImagineNet_Detail { auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [jlohiser(a)imaginenet.net/<no User-Password attribute>] (from client fw1.cle1.oh.imaginenet.net port 0 via TLS tunnel) } # server ImagineNet_Detail Going to the next request <<< Received proxied response from internal virtual server. Login incorrect (Home Server says so): [jlohiser(a)imaginenet.net/<no User-Password attribute>] (from client fw1.cle1.oh.imaginenet.net port 0) Sending Access-Reject of id 81 to 192.168.0.10 port 51144 Finished request 0. Cleaning up request 0 ID 81 with timestamp +22

2 5

Run as non-privileged user
by Lemaster, Rob 05 May '08

05 May '08

FreeRADIUS 2.0.4 Some documentation I've read recommends running FreeRADIUS as user=radius group=radius. It said that you shouldn't use "nobody" because that is reserved for a special purpose (I think it was the Hassel book). Around line 116 of radiusd.conf, I found the option for "user/group", but the instructions say that you must be root to start the server. If I change this setting, will it prevent the server from starting? What is the official recommended way of running FreeRADIUS as a non-root user? Thanks for your time!

2 1

Weird shared secret issues
by Tuc at T-B-O-H.NET 04 May '08

04 May '08

Hi, Running FreeRadius 2.0.3 built from source on Centos 5.1 with a Mysql 5.0.45 back end. We've been doing testing on our setup for MONTHS (First FR1, now FR2) and its been flawless. Today we went to put our first unit into production and am having issues. We are reading NAS from SQL. The entry is : (3,'192.168.25.13','SBC-1918','other',0,'KhLcPALLdzTcJs3f','GLRXTAFLfhf3N4zT','First Install') From the user table I have : (1, 'tuc','User-Password',':=','PLAINTEXT') And when I run : #!/bin/sh (echo 'User-Name = "tuc"' echo 'User-Password = "PLAINTEXT"' echo 'NAS-IP-Address = 192.168.25.13' echo 'NAS-Port = 0') | /usr/local/bin/radclient -x localhost auth KhLcPALLdzTcJs3f I get : [root@ports ~]# sh TESTRAD User-Name = "tuc" User-Password = "PLAINTEXT" NAS-IP-Address = 192.168.25.13 NAS-Port = 0 rad_verify: Received Access-Reject packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) and in radius.log I see : Wed Apr 30 16:38:43 2008 : Auth: Login incorrect: [tuc/eY\261㡩\226`\305\020y\366/�?\333] (from client localhost port 0) HELP... I can't see what I'm doing wrong. Thanks, Tuc

4 10

Strategy Advice
by Sturgis, Grant 04 May '08

04 May '08

Greetings list, Brand new freeradius user here, I will try not to be too obnoxious with silly questions. My goal is to replace the Cisco ACS solution with Freeradius, including: 1. Shell (telnet/ssh) access to network switches/routers/firewalls 2. EAP-TLS to the wireless network 3. Potentially 802.1x auth to wired network ports I would like to use our network directory (W2K3 AD) user accounts for all of the above. And I would also like to be able to restrict based on group membership - so that only members of the "Cisco_Admin" group can log into switches and only members of the "wireless" group can authenticate to the WAPs. My questions is: Would it be wiser to pursue the mschap / ntml_auth / winbind module solution or the ldap module solution? I am guessing that this has been done in the past, right? Does anyone have any anecdotes that would be helpful? Thanks in advance, Grant ----------------- Pardon this rubbish: This electronic message transmission is a PRIVATE communication which contains information which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. Please notify the sender of the delivery error by replying to this message, or notify us by telephone (877-633-2436, ext. 0), and then delete it from your system.

6 7

FR failing
by Matt Ashfield 04 May '08

04 May '08

We have two FR servers (running 1.1.15) on Red Hat machines. We are using it to authenticate wireless users against an LDAP directory. Occasionally, one of the FR servers (it happens to each, just not at the same time), stops working. The service remains up, but it's like the conversation between radius and ldap doesn't work for some reason, and radius stops trying altogether afterwards. The log shows: Thu May 1 14:33:02 2008 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Thu May 1 14:33:02 2008 : Auth: Login incorrect: [rsmall] (from client unbsj111 port 32401 cli 00-1E-C2-C0-8E-36) Thu May 1 14:33:15 2008 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Thu May 1 14:33:15 2008 : Auth: Login incorrect: [anonymous] (from client hh2380 port 45380 cli 00-12-F0-D3-3C-03) Thu May 1 14:34:02 2008 : Error: Discarding duplicate request from client hh2380:20001 - ID: 200 due to unfinished request 1428 Any help is greatly appreciated. Thanks Matt A mda(a)unb.ca

2 1

freeradius 2.0.4 and peap
by Manuel Sánchez Cuenca 04 May '08

04 May '08

Hello all, I have installed freeradius 2.0.4 and now I'm trying to configure peap. When I try to connect using a Windows XP laptop, the server rejects the user. The log shows this information: rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for lolo with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect: [lolo/<via Auth-Type = EAP>] (from client dame-ap port 0 via TLS tunnel) PEAP: Tunneled authentication was rejected. The configuration files are the following: * eap.conf eap { default_eap_type = peap . . . tls { private_key_password = srvpwd private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem . . . } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } mschapv2 { } * users lolo Cleartext-Password := "password" * sites-enabled/default authorize { eap { ok = return } ... } authenticate { eap ... } ... Can anybody help me? Thanks in advance. -- ----------------------------- Manuel Sanchez Cuenca Departamento de Ingenieria de la Informacion y las Comunicaciones Departamento de Ingeniería y Tecnología de Computadores Facultad de Informatica. Universidad de Murcia Campus de Espinardo - 30080 Murcia (SPAIN) Tel.: +34-968-364644 Fax: +34-968-364151 email: msc(a)dif.um.es | manuelsc(a)um.es url: http://webs.um.es/manuelsc

3 3

Re:Re Can't get the value of 'Digest-User-name', 'Digest-Realm', 'Digest-Method', 'Digest-Uri', 'Digest-Nonce', 'Digest-Response'
by johnson elangbam 03 May '08

03 May '08

>Your radius client is not sending Digest-Attributes. It's sending Ascend >VSAs. Read your NAS documentation how to set up digest authentication if >you want that. hi Kalik, I am really sorry to post again the same question, as per your instruction I have check all the clients configurations "radiusclient.conf" as well as SER configuration "ser.cfg", I've uncommented all the modules that will particularly help to do digest authentication in ser.cfg, but still the problem of not getting the values of digest attributes exist, I am using radiusclient 0.5.6 and SER 0.9.6, will it be the problem for incompatible of versions between the radius server and the radius clients or SER. Please tell me the possible problems of not getting these values: 'Digest-User-name', 'Digest-Realm', 'Digest-Method', 'Digest-Uri', 'Digest-Nonce', 'Digest-Response' And please tell me the things that I should change in radius server configuration to get these digest attributes. for the information I've mentioning the debug when run in radiusd -X rad_recv: Access-Request packet from host 192.168.1.227 port 33526, id=92, length=252 User-Name = "john(a)192.168.1.227" X-Ascend-Netware-timeout = 1785686126 X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 X-Ascend-Receive-Secret = 0x34383163393137633262316333323731373133343937623838636165613864326437326534653832 X-Ascend-IP-Pool-Definition = "sip:192.168.1.227" X-Ascend-IPX-Peer-Mode = 0x5245474953544552 Digest-Response = "6d1bf8eacbbddb82a606811f7e5c76ae" Service-Type = IAPP-Register X-Ascend-PW-Lifetime = 1785686126 Cisco-AVPair = "call-id= ef6d9d206ac3449895bba4e95ea6110e(a)192.168.1.193" NAS-IP-Address = 127.0.0.1 NAS-Port = 5060 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0x9f48768 asigned new request. Handled so far: 1 found interpetator at address 0x9f48768 rlm_perl: ############################################################### rlm_perl: RAD_REQUEST: Digest-Response = 6d1bf8eacbbddb82a606811f7e5c76ae rlm_perl: RAD_REQUEST: X-Ascend-Receive-Secret = 0x34383163393137633262316333323731373133343937623838636165613864326437326534653832 rlm_perl: RAD_REQUEST: X-Ascend-IPX-Peer-Mode = 0x5245474953544552 rlm_perl: RAD_REQUEST: Service-Type = IAPP-Register rlm_perl: RAD_REQUEST: X-Ascend-Netware-timeout = 1785686126 rlm_perl: RAD_REQUEST: Cisco-AVPair = call-id= ef6d9d206ac3449895bba4e95ea6110e(a)192.168.1.193 rlm_perl: RAD_REQUEST: X-Ascend-IP-Pool-Definition = sip:192.168.1.227 rlm_perl: RAD_REQUEST: User-Name = john(a)192.168.1.227 rlm_perl: RAD_REQUEST: X-Ascend-PW-Lifetime = 1785686126 rlm_perl: RAD_REQUEST: NAS-Port = 5060 rlm_perl: RAD_REQUEST: NAS-IP-Address = 127.0.0.1 rlm_perl: RAD_REQUEST: X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 rlm_perl: ############################################################### rlm_perl: Added pair Digest-Response = 6d1bf8eacbbddb82a606811f7e5c76ae rlm_perl: Added pair X-Ascend-Receive-Secret = 0x34383163393137633262316333323731373133343937623838636165613864326437326534653832 rlm_perl: Added pair X-Ascend-IPX-Peer-Mode = 0x5245474953544552 rlm_perl: Added pair Service-Type = IAPP-Register rlm_perl: Added pair X-Ascend-Netware-timeout = 1785686126 rlm_perl: Added pair Cisco-AVPair = call-id= ef6d9d206ac3449895bba4e95ea6110e(a)192.168.1.193 rlm_perl: Added pair X-Ascend-IP-Pool-Definition = sip:192.168.1.227 rlm_perl: Added pair User-Name = john(a)192.168.1.227 rlm_perl: Added pair X-Ascend-PW-Lifetime = 1785686126 rlm_perl: Added pair NAS-Port = 5060 rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 rlm_perl: Added pair Reply-Message = Incorrect Password perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x9f48768 ++[perl] returns reject Invalid user: [john(a)192.168.1.227/<no User-Password attribute>] (from client 192.168.1.227 port 5060) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> john(a)192.168.1.227 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.1.227 port 33528, id=93, length=252 User-Name = "john(a)192.168.1.227" X-Ascend-Netware-timeout = 1785686126 X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 X-Ascend-Receive-Secret = 0x34383163393137633262316333323731373133343937623838636165613864326437326534653832 X-Ascend-IP-Pool-Definition = "sip:192.168.1.227" X-Ascend-IPX-Peer-Mode = 0x5245474953544552 Digest-Response = "6d1bf8eacbbddb82a606811f7e5c76ae" Service-Type = IAPP-Register X-Ascend-PW-Lifetime = 1785686126 Cisco-AVPair = "call-id= ef6d9d206ac3449895bba4e95ea6110e(a)192.168.1.193" NAS-IP-Address = 127.0.0.1 NAS-Port = 5060 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0xa183d50 asigned new request. Handled so far: 1 found interpetator at address 0xa183d50 rlm_perl: ############################################################### rlm_perl: RAD_REQUEST: Digest-Response = 6d1bf8eacbbddb82a606811f7e5c76ae rlm_perl: RAD_REQUEST: X-Ascend-Receive-Secret = 0x34383163393137633262316333323731373133343937623838636165613864326437326534653832 rlm_perl: RAD_REQUEST: X-Ascend-IPX-Peer-Mode = 0x5245474953544552 rlm_perl: RAD_REQUEST: Service-Type = IAPP-Register rlm_perl: RAD_REQUEST: X-Ascend-Netware-timeout = 1785686126 rlm_perl: RAD_REQUEST: Cisco-AVPair = call-id= ef6d9d206ac3449895bba4e95ea6110e(a)192.168.1.193 rlm_perl: RAD_REQUEST: X-Ascend-IP-Pool-Definition = sip:192.168.1.227 rlm_perl: RAD_REQUEST: User-Name = john(a)192.168.1.227 rlm_perl: RAD_REQUEST: X-Ascend-PW-Lifetime = 1785686126 rlm_perl: RAD_REQUEST: NAS-Port = 5060 rlm_perl: RAD_REQUEST: NAS-IP-Address = 127.0.0.1 rlm_perl: RAD_REQUEST: X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 rlm_perl: ############################################################### rlm_perl: Added pair Digest-Response = 6d1bf8eacbbddb82a606811f7e5c76ae rlm_perl: Added pair X-Ascend-Receive-Secret = 0x34383163393137633262316333323731373133343937623838636165613864326437326534653832 rlm_perl: Added pair X-Ascend-IPX-Peer-Mode = 0x5245474953544552 rlm_perl: Added pair Service-Type = IAPP-Register rlm_perl: Added pair X-Ascend-Netware-timeout = 1785686126 rlm_perl: Added pair Cisco-AVPair = call-id= ef6d9d206ac3449895bba4e95ea6110e(a)192.168.1.193 rlm_perl: Added pair X-Ascend-IP-Pool-Definition = sip:192.168.1.227 rlm_perl: Added pair User-Name = john(a)192.168.1.227 rlm_perl: Added pair X-Ascend-PW-Lifetime = 1785686126 rlm_perl: Added pair NAS-Port = 5060 rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 rlm_perl: Added pair Reply-Message = Incorrect Password perl_pool total/active/spare [32/0/32] Unreserve perl at address 0xa183d50 ++[perl] returns reject Invalid user: [john(a)192.168.1.227/<no User-Password attribute>] (from client 192.168.1.227 port 5060) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> john(a)192.168.1.227 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.4 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 92 to 192.168.1.227 port 33526 Reply-Message = "Incorrect Password" Waking up in 0.5 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 93 to 192.168.1.227 port 33528 Reply-Message = "Incorrect Password" Waking up in 4.4 seconds. Cleaning up request 0 ID 92 with timestamp +5 Waking up in 0.5 seconds. Cleaning up request 1 ID 93 with timestamp +5 Ready to process requests. Thanks and Regards, Elangbam Johnson

2 1