May 2008 - Freeradius-Users - lists.freeradius.org

howto EAP-TLS on freeradius 2.0.2-3 ??
by Joel MBA OYONE 03 May '08

03 May '08

OK, radiusd -X and /etc/raddb/certs/bootstrap generated some files in /etc/raddb/certs like ca.pem ca.key 01.pem dh index.txt index.txt.attr random serial server.crt srver.key server.p12 server.pem server.csr xpxtensions etc... eap.conf point to the right paths. i intend to authenticate wireless users on xp. i though there was already a certificate and private key for wireless client, but i can see that nowhere. si i think i should create my own certificate and privatekey for client and export install it on windows xp. if i am true and did not forget something to do, my questions are: - is there any problem with the CA private key file and server file extension? (ca.key instead of cakey.pem). - which extension should i use for my windows xp certicate, and please, could you just give me the line! (like openssl req ...., openssl ca - ...-, openssl pkcs12, etc...) sorry for silly questions, but i tried and surely missed something. thank you for helping MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

1 0

Re : authentication problem between supplicant and radius server
by Joel MBA OYONE 03 May '08

03 May '08

thank you guy! It works, with only the @MAC ("00-1c-f0-07-d6-90") instead of "00-1c-f0-07-d6-90\000". I wonder why the Radius server receive that "\000" information. MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 ----- Message d'origine ---- De : Ivan Kalik <tnt(a)kalik.net> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Vendredi, 2 Mai 2008, 19h34mn 11s Objet : Re: authentication problem between supplicant and radius server >I need some explanation with what is going wrong in my config! > >i have : > - freeradius 2.0.2-3 AS RADIUS SERVER >- DWS3024 as authenticator (set up for transmit request to radius server correctly) >- (this step) DWL-8500AP as Access point (my spplicant) > >i had not that problem using that config on my previous system (fedora 8 + freeradius 1.1-7). > >"Radiusd - X" telles me that there is no "User-Password" attribute found on the request whent the Access-Point (AP) tries to authenticate. >it shows me "@MAC_ADDRESS" as login and "000# as password. >the suppliers doc says default password is "NOPASSWORD". >when i update the password in "users" file as "NOPASSWORD" or "000" or hen i leave it empty, i have exactly the same results. > >below is my radiusd -X log, a part of my clients.cnf. file and same of "users" file. >maybe could someone tell me what i missed. > .. >rad_recv: Access-Request packet from host 192.168.0.254 port 49153, id=73, length=79 > User-Name = "00-1c-f0-07-d6-90\000" > NAS-Identifier = "00-17-9A-95-0C-18" > Message-Authenticator = 0xe7734b66fdcbf582530af8458ee4627e AP is not sending anything as password. >########################################################### > >"Users" file >########################################################### >#### AP 1 Auth-Type := Local, >00-1c-f0-07-d6-90\000 Auth-Type := Local, User-Password += "000" Alter this to (and leave reply attributes as they are): 00-1c-f0-07-d6-90\000 Auth-Type := Accept Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

1 0

authentication problem between supplicant and radius server
by Joel MBA OYONE 02 May '08

02 May '08

Hello I need some explanation with what is going wrong in my config! i have : - freeradius 2.0.2-3 AS RADIUS SERVER - DWS3024 as authenticator (set up for transmit request to radius server correctly) - (this step) DWL-8500AP as Access point (my spplicant) i had not that problem using that config on my previous system (fedora 8 + freeradius 1.1-7). "Radiusd - X" telles me that there is no "User-Password" attribute found on the request whent the Access-Point (AP) tries to authenticate. it shows me "@MAC_ADDRESS" as login and "000# as password. the suppliers doc says default password is "NOPASSWORD". when i update the password in "users" file as "NOPASSWORD" or "000" or hen i leave it empty, i have exactly the same results. below is my radiusd -X log, a part of my clients.cnf. file and same of "users" file. maybe could someone tell me what i missed. thank you # radiusd -X ############## FreeRADIUS Version 2.0.2, for host i686-suse-linux-gnu, built on Mar 18 2008 at 19:47:59 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including configuration file /etc/raddb/snmp.conf including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" user = "radiusd" group = "radiusd" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client dws3024 { ipaddr = 192.168.0.254 require_message_authenticator = yes secret = "wireless" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.254 port 49153, id=73, length=79 User-Name = "00-1c-f0-07-d6-90\000" NAS-Identifier = "00-17-9A-95-0C-18" Message-Authenticator = 0xe7734b66fdcbf582530af8458ee4627e +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "00-1c-f0-07-d6-90", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [00-1c-f0-07-d6-90\000/<no User-Password attribute>] (from client dws3024 port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> 00-1c-f0-07-d6-90 ++[attr_filter.access_reject] returns noop Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 73 to 192.168.0.254 port 49153 Waking up in 4.9 seconds. ########################################################### "clients.conf" ########################################################### # format 2.x client dws3024 { ipaddr = 192.168.0.254 # netmask = 24 secret = wireless require_message_authenticator = yes # shortname = DWS-3024 Swithch Controler # nastype = D-Link } ########################################################### "Users" file ########################################################### #### AP 1 Auth-Type := Local, 00-1c-f0-07-d6-90\000 Auth-Type := Local, User-Password += "000" D-Link-Wireless-AP-Mode = WS-Managed, D-Link-Wireless-AP-Location = "Bureau de Joel", D-Link-Wireless-AP-Profile-ID = 1, D-Link-Wireless-AP-Switch-IP = 192.168.10.254, D-Link-Wireless-AP-Radio-1-Chan = Auto, D-Link-Wireless-AP-Radio-2-Chan = Auto, D-Link-Wireless-AP-Radio-1-Power = Auto, D-Link-Wireless-AP-Radio-2-Power = Auto 00-17-9a-d2-e8-f0 Auth-Type := Local, Cleartext-Password == "000" D-Link-Wireless-AP-Mode = WS-Managed, D-Link-Wireless-AP-Location = "Bureau de Joel", D-Link-Wireless-AP-Profile-ID = 1, D-Link-Wireless-AP-Switch-IP = 192.168.0.254, D-Link-Wireless-AP-Radio-1-Chan = Auto, D-Link-Wireless-AP-Radio-2-Chan = Auto, D-Link-Wireless-AP-Radio-1-Power = Auto, D-Link-Wireless-AP-Radio-2-Power = Auto ########################################################################################### __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

2 1

DER format in TLS certificates
by Sergio Belkin 02 May '08

02 May '08

Hi, Can I use DER format for certificates? With PEM format TTLS works fine but if I use DER format it outputs: Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/pki/tls/certs/ips-spectrum-key.der" certificate_file = "/etc/pki/tls/certs/ips-spectrum-crt.der" CA_file = "/etc/pki/tls/certs/ips-ca-bundle.der" dh_file = "/usr/local-2.0.2/etc/raddb/certs/dh" random_file = "/usr/local-2.0.2/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } rlm_eap: SSL error error:0906D06C:PEM routines:PEM_read_bio:no start line rlm_eap_tls: Error reading certificate file /etc/pki/tls/certs/ips-spectrum-crt.der rlm_eap: Failed to initialize type tls /usr/local-2.0.2/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /usr/local-2.0.2/etc/raddb/sites-enabled/default[253]: Failed to find module "eap". /usr/local-2.0.2/etc/raddb/sites-enabled/default[200]: Errors parsing authenticate section. } } Errors initializing modules Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

1 0

Ldap attribute config stuff
by Pat Riehecky 02 May '08

02 May '08

Ok, to begin I am not a radius guru. In fact, the word novice applies very strongly here.... That being said on to my inquiry. I have two radius systems on site. One of them is for our wireless system and the other for our old trying to die dialup. The wireless system is setup to authenticate to our LDAP repository and make sure that users have a particular attribute before letting them on. Our dial up system is a big mess of flat files on a version of the software I wont admit to. I would very much like to get the radius server doing the wireless work to also do our dial up work. To do this I have loaded some attributes into our LDAP server for it to query, but then I run into a bit of a problem. How do I configure a required attribute of "Wireless=yes" for one set of clients and an attribute of "DialUP=yes" for the other? Can this be done? Did I miss the doc on this? Solaris 9 SPARC, FreeRadius 1.1.6 Any help I can get on this would be very appreciated. Pat

1 0

Discard duplicate requests if received within a specified period
by rsg 02 May '08

02 May '08

Hi, I would like to discard duplicate Auth requests based on certain attributes other than the NAS-IP-Address (e.g. Calling-Station-Id, Pool-Name). For example if there are two requests originating from 2 NASes which corresponds to a particular client, I would like to discard the second request if it is received during a threshold time value (eg. 15 seconds) Specially I find that when using SQL for authorization this situation occurs as it takes a while to perform authorization using SQL. Thanks for your guidance, rg

4 13

Suggestion for modules directory
by Jim L. 02 May '08

02 May '08

If the FreeRADIUS team monitors this list, I have a small suggestion. Along with the sites-available/sites-enabled directories, I would like to suggest a similar configuration for the modules section. I have added this to our servers and placed all of my custom module sections in corresponding configuration files under the modules directory. As with the sites directories, this allows me to make less modifications to radiusd.conf. Also, I can easily split up the per-site module configurations into separate module files. I do not know if something like modules-available/modules-enabled is really necessary. Perhaps just "$INCLUDE modules/" in under the modules section would be sufficient. Thanks, Jim Lohiser

2 1

Re: Can't get the value of 'Digest-User-name', 'Digest-Realm', 'Digest-Method', 'Digest-Uri', 'Digest-Nonce', 'Digest-Response'
by johnson elangbam 02 May '08

02 May '08

>Send a request with Digest-Attributes. hi Kalik, I've tried to called using Digest-Attributes in my perl code like this $dUserName= $RAD_REQUEST{'Digest-User-Name'}; $dRealm= $RAD_REQUEST{'Digest-Realm'}; $dMethod = $RAD_REQUEST{'Digest-Method'}; $dUri= $RAD_REQUEST{'Digest-URI'}; $dNonce=$RAD_REQUEST{'Digest-Nonce'}; $dResponse=$RAD_REQUEST{'Digest-Response'}; but still it doesn't get the values..except 'Digest-Response' May it be the problem from the radius client, or is it the problem in my perl code. I can't rectify the problem, I am confusing where should I emphasized Here is the new output when it is run in radiusd -X after rejecting da user. rad_recv: Access-Request packet from host 192.168.1.227 port 32847, id=182, length=252 User-Name = "john(a)192.168.1.227" X-Ascend-Netware-timeout = 1785686126 X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 X-Ascend-Receive-Secret = 0x34383161663338653534346236663063383862343865393864346639313036626264363230306536 X-Ascend-IP-Pool-Definition = "sip:192.168.1.227" X-Ascend-IPX-Peer-Mode = 0x5245474953544552 Digest-Response = "1e926599fa0777bef89010421e3e1c41" Service-Type = IAPP-Register X-Ascend-PW-Lifetime = 1785686126 Cisco-AVPair = "call-id= 25b5a186aad84c2fa769946f1b1c7110(a)192.168.1.193" NAS-IP-Address = 127.0.0.1 NAS-Port = 5060 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0x9ede730 asigned new request. Handled so far: 1 found interpetator at address 0x9ede730 rlm_perl: ############################################################### rlm_perl: RAD_REQUEST: Digest-Response = 1e926599fa0777bef89010421e3e1c41 rlm_perl: RAD_REQUEST: X-Ascend-Receive-Secret = 0x34383161663338653534346236663063383862343865393864346639313036626264363230306536 rlm_perl: RAD_REQUEST: X-Ascend-IPX-Peer-Mode = 0x5245474953544552 rlm_perl: RAD_REQUEST: Service-Type = IAPP-Register rlm_perl: RAD_REQUEST: X-Ascend-Netware-timeout = 1785686126 rlm_perl: RAD_REQUEST: Cisco-AVPair = call-id= 25b5a186aad84c2fa769946f1b1c7110(a)192.168.1.193 rlm_perl: RAD_REQUEST: X-Ascend-IP-Pool-Definition = sip:192.168.1.227 rlm_perl: RAD_REQUEST: User-Name = john(a)192.168.1.227 rlm_perl: RAD_REQUEST: X-Ascend-PW-Lifetime = 1785686126 rlm_perl: RAD_REQUEST: NAS-Port = 5060 rlm_perl: RAD_REQUEST: NAS-IP-Address = 127.0.0.1 rlm_perl: RAD_REQUEST: X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 rlm_perl: ############################################################### rlm_perl: Added pair Digest-Response = 1e926599fa0777bef89010421e3e1c41 rlm_perl: Added pair X-Ascend-Receive-Secret = 0x34383161663338653534346236663063383862343865393864346639313036626264363230306536 rlm_perl: Added pair X-Ascend-IPX-Peer-Mode = 0x5245474953544552 rlm_perl: Added pair Service-Type = IAPP-Register rlm_perl: Added pair X-Ascend-Netware-timeout = 1785686126 rlm_perl: Added pair Cisco-AVPair = call-id= 25b5a186aad84c2fa769946f1b1c7110(a)192.168.1.193 rlm_perl: Added pair X-Ascend-IP-Pool-Definition = sip:192.168.1.227 rlm_perl: Added pair User-Name = john(a)192.168.1.227 rlm_perl: Added pair X-Ascend-PW-Lifetime = 1785686126 rlm_perl: Added pair NAS-Port = 5060 rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 rlm_perl: Added pair Reply-Message = Incorrect Password perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x9ede730 ++[perl] returns reject Invalid user: [john(a)192.168.1.227/<no User-Password attribute>] (from client 192.168.1.227 port 5060) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> john(a)192.168.1.227 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 192.168.1.227 port 32848, id=183, length=252 User-Name = "john(a)192.168.1.227" X-Ascend-Netware-timeout = 1785686126 X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 X-Ascend-Receive-Secret = 0x34383161663338653534346236663063383862343865393864346639313036626264363230306536 X-Ascend-IP-Pool-Definition = "sip:192.168.1.227" X-Ascend-IPX-Peer-Mode = 0x5245474953544552 Digest-Response = "1e926599fa0777bef89010421e3e1c41" Service-Type = IAPP-Register X-Ascend-PW-Lifetime = 1785686126 Cisco-AVPair = "call-id= 25b5a186aad84c2fa769946f1b1c7110(a)192.168.1.193" NAS-IP-Address = 127.0.0.1 NAS-Port = 5060 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0xa119d28 asigned new request. Handled so far: 1 found interpetator at address 0xa119d28 rlm_perl: ############################################################### rlm_perl: RAD_REQUEST: Digest-Response = 1e926599fa0777bef89010421e3e1c41 rlm_perl: RAD_REQUEST: X-Ascend-Receive-Secret = 0x34383161663338653534346236663063383862343865393864346639313036626264363230306536 rlm_perl: RAD_REQUEST: X-Ascend-IPX-Peer-Mode = 0x5245474953544552 rlm_perl: RAD_REQUEST: Service-Type = IAPP-Register rlm_perl: RAD_REQUEST: X-Ascend-Netware-timeout = 1785686126 rlm_perl: RAD_REQUEST: Cisco-AVPair = call-id= 25b5a186aad84c2fa769946f1b1c7110(a)192.168.1.193 rlm_perl: RAD_REQUEST: X-Ascend-IP-Pool-Definition = sip:192.168.1.227 rlm_perl: RAD_REQUEST: User-Name = john(a)192.168.1.227 rlm_perl: RAD_REQUEST: X-Ascend-PW-Lifetime = 1785686126 rlm_perl: RAD_REQUEST: NAS-Port = 5060 rlm_perl: RAD_REQUEST: NAS-IP-Address = 127.0.0.1 rlm_perl: RAD_REQUEST: X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 rlm_perl: ############################################################### rlm_perl: Added pair Digest-Response = 1e926599fa0777bef89010421e3e1c41 rlm_perl: Added pair X-Ascend-Receive-Secret = 0x34383161663338653534346236663063383862343865393864346639313036626264363230306536 rlm_perl: Added pair X-Ascend-IPX-Peer-Mode = 0x5245474953544552 rlm_perl: Added pair Service-Type = IAPP-Register rlm_perl: Added pair X-Ascend-Netware-timeout = 1785686126 rlm_perl: Added pair Cisco-AVPair = call-id= 25b5a186aad84c2fa769946f1b1c7110(a)192.168.1.193 rlm_perl: Added pair X-Ascend-IP-Pool-Definition = sip:192.168.1.227 rlm_perl: Added pair User-Name = john(a)192.168.1.227 rlm_perl: Added pair X-Ascend-PW-Lifetime = 1785686126 rlm_perl: Added pair NAS-Port = 5060 rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair X-Ascend-Send-Secret = 0x3139322e3136382e312e323237 rlm_perl: Added pair Reply-Message = Incorrect Password perl_pool total/active/spare [32/0/32] Unreserve perl at address 0xa119d28 ++[perl] returns reject Invalid user: [john(a)192.168.1.227/<no User-Password attribute>] (from client 192.168.1.227 port 5060) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> john(a)192.168.1.227 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.4 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 182 to 192.168.1.227 port 32847 Reply-Message = "Incorrect Password" Waking up in 0.5 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 183 to 192.168.1.227 port 32848 Reply-Message = "Incorrect Password" Waking up in 4.4 seconds. Cleaning up request 0 ID 182 with timestamp +10 Waking up in 0.5 seconds. Cleaning up request 1 ID 183 with timestamp +10 Ready to process requests. thanking you Kalik. With Regards, Elangbam Johnson

2 1

Re : Re : Re : EAP-TLS/PEAP problem
by Joel MBA OYONE 02 May '08

02 May '08

Ok, i am sorry! all i had to do is "yast install make" or something like that to be able to run the command... ah... Linux !! MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 ----- Message d'origine ---- De : Joel MBA OYONE <mba_oyone(a)yahoo.fr> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Vendredi, 2 Mai 2008, 9h50mn 05s Objet : Re : Re : EAP-TLS/PEAP problem Hello list, I've just installed SUSE 10.3 and freeradius 2.0.2.2-3 to easily setup my prevoious prob with eap. right now, when i run "radiusd -W" i encounter this error message: === /etc/raddb/certs/bootstrap: line 15: make: command not found Exec-Program output: Exec-Program: returned: 127 rlm_eap: Failed to initialize type tls /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /etc/raddb/sites-enabled/default[252]: Failed to find module "eap". /etc/raddb/sites-enabled/default[199]: Errors parsing authenticate section. } } Errors initializing modules == reading the readme file in certs/ directory, i understood that the script bootstrap should create the certificates and some other stuffs, and the should be renamed or destroyed. - that i see is: the script didn't create nothing and could not be run. could you please help me to fix it? ( my final goes is to use eap-tls / eap-peap to athenticate wireless clients, and like i said before, i am really newbie on linux. thanx for help) MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 ----- Message d'origine ---- De : Ivan Kalik <tnt(a)kalik.net> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Mercredi, 30 Avril 2008, 11h39mn 36s Objet : Re: Re : EAP-TLS/PEAP problem http://www.freeradius.org/download.html Find the OS version that you have and download the latest freeradius version rpm. Ivan Kalik Kalik Informatika ISP Dana 30/4/2008, "Joel MBA OYONE" <mba_oyone(a)yahoo.fr> piše: >Well, as i am very very newbie on Linux. iuse to work on win2000/2003 before. >Â i chose the easyway to install freeradius; the "yum" commaand gave me that version. >if the latest version is easy to install manuallyÂ on fedora and is able to work on a hp proliant ml-370 g5, i take it. >Why not the latest version. It will create and install the certificates >for you. Even if you don't want to install it you can download it and >use it to create certificates. > >Ivan Kalik >Kalik Informatika ISP > > >Dana 30/4/2008, "Joel MBA OYONE" <mba_oyone(a)yahoo.fr> piĹĄe: > >>Hello list. >>I am sorry about my poor english skills but hope iĂÂ could be understood anyway. >>I use freeradius 1.1-7 on fedora 8 (installed with yum command).ĂÂ right now, my users in the "/etc/raddb/users" file are able to authenticate without no problem. >>iĂÂ intend to use eap-tls and eap-peap to authenticate my users. to do so, i read this tutorial: http://www.wi-fiplanet.com/tutorials/article.php/3557251ĂÂ (two sheets) which is very helpfull. >>but on the second part of the tuto,ĂÂ i encounter a problem with the extensions part: >>- it is said to create a file named "extensions" (my case /etc/pki/tls/extensions) and to copy that lines into: >>[ xpclient_ext] >>extendedKeyUsage = 1.3.6.1.5.5.7.3.2 >>[ xpserver_ext ] >>extendedKeyUsage = 1.3.6.1.5.5.7.3.1 >>and then to modify my previous certificate like that: >># openssl ca -out master_cert.pem -extensions xpserver -infiles ./masterreqpem >># openssl ca -out client_cert.pem -extensions xpserver -infiles ./clientreqpem >>when i do this, the system give me an error message: >>[root@ensiasra ensiasCA]# pwd >>/etc/pki/CA/ensiasCA >>[root@ensiasra ensiasCA]# openssl ca -out certs/ensias_cert.pem -extensions xpserver_ext -infiles certs/radiusserverreq.pem >>Using configuration from /etc/pki/tls/openssl.cnf >>Enter pass phrase for /etc/pki/CA/ensiasCA/private/cakey.pem: >>Error Loading extension section xpserver_ext >>4230:error:0E06D06C:configuration file routines:NCONF_get_string:no value:conf_lib.c:329:group=CA_default name=email_in_dn >>[root@ensiasra ensiasCA]# >> >>i suppose i have problem creating extensions.... >>there's a long time i try to fix it (and some many before), and right now, i come and ask your help to fix it. >>thanx for helping >> >>ĂÂ >>MBA OYONE JoÄĹ¤l >>Lot.. El Firdaous >>BÄËt GH20, Porte A 204, Appt 8 >>20000 Oulfa >>Casablanca - Maroc >>ĂÂ >>TÄĹ l. : +212 69 25 85 70 >> >>__________________________________________________ >>Do You Yahoo!? >>En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicitÄĹ s >>http://mail.yahoo.fr Yahoo! Mail >> > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > >__________________________________________________ >Do You Yahoo!? >En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicitĂŠs >http://mail.yahoo.fr Yahoo! Mail > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

1 0

EAP/TLS on windows XP clients?
by Johan Nyman 02 May '08

02 May '08

Hello, What certificates are needed on Windows XP clients to make a successful connection? The client.p12? and more? Thanks, Best regards, Johan

3 3