May 2008 - Freeradius-Users - lists.freeradius.org

EAP-TTLS/MSCHAPv2
by sriram 29 May '08

29 May '08

Hi All, I am facing problem using the FreeRadius version 1.1.7 for EAP-TTLS/MSCHAPv2. Always I keep seeing the access-challenge on the radius log. I have attached the eap.conf / wpa_supplicant.conf and radius traces for your reference. Please, let me know If there is anything wrong in my configurations. Thanks & Regards, Sriram

2 1

Freeradius book
by orion 29 May '08

29 May '08

Hi alan. Whats up with your book? When will comes out?

3 2

EAP-TLS -- first timer
by Joseph S. Dietz, Jr. 28 May '08

28 May '08

Hi, I am new to FR... I was able to get freeradius to work with EAP-MD5 passwords using an XP client. I can not seem to get free raidus working with Certs. I need some help debugging the issue. radiusd -v radiusd: FreeRADIUS Version 2.0.1, for host i386-pc-solaris2.9, built on May 1 2008 at 16:01:29 version OpenSSL 0.9.8g 19 Oct 2007 I have patched the XP system per the FR howto... I seem to have certs created right? But no authentication... I've tried googl'n the issue, but I need a little more help understanding what is happening. thanks in advance for your time, Joe Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "abc123" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } ... ... ... rad_recv: Access-Request packet from host 1.2.3.126 port 1024, id=28, length=167 User-Name = "joe" NAS-IP-Address = 1.2.3.126 NAS-Identifier = "00:08:da:57:3f:63" NAS-Port = 0 Called-Station-Id = "00-08-DA-57-3F-61:" Calling-Station-Id = "00-1A-4B-61-9C-C8" Framed-MTU = 1400 NAS-Port-Type = Ethernet Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000c016a73646965747a Message-Authenticator = 0x4f6d8dd3b1012bc9f500b915421a8fe3 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "joe", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 0 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rad_recv: Access-Request packet from host 1.2.3.126 port 1024, id=28, length=167 User-Name = "joe" NAS-IP-Address = 1.2.3.126 NAS-Identifier = "00:08:da:57:3f:63" NAS-Port = 0 Called-Station-Id = "00-08-DA-57-3F-61:" Calling-Station-Id = "00-1A-4B-61-9C-C8" Framed-MTU = 1400 NAS-Port-Type = Ethernet Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000c016a73646965747a Message-Authenticator = 0x4f6d8dd3b1012bc9f500b915421a8fe3 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "joe", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 0 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 1.2.3.126 port 1024, id=29, length=253 User-Name = "joe" NAS-IP-Address = 1.2.3.126 NAS-Identifier = "00:08:da:57:3f:63" NAS-Port = 0 Called-Station-Id = "00-08-DA-57-3F-61:" Calling-Station-Id = "00-1A-4B-61-9C-C8" Framed-MTU = 1400 NAS-Port-Type = Ethernet Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100500d800000004616030100410100003d03014829bb9f9cfe85aa6ac13f1df8fff02e7c2ce116dcee5d0847a173bddd4fab7d00001600040005000a000900640062000300060013001200630100 State = 0xbbdf20d6bbde2d9285f320de1e094fc7 Message-Authenticator = 0xcfd61b81787d9db0dbc4487e94abba8d +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "joe", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS TLS Length 70 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 06f6], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 008b], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 29 to 1.2.3.126 port 1024 EAP-Message = 0x010204000dc0000007... EAP-Message = 0x83300d06092a864886f70d01 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbbdf20d6badd2d9285f320de1e094fc7 Finished request 5. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 1.2.3.126 port 1024, id=30, length=179 User-Name = "joe" NAS-IP-Address = 1.2.3.126 NAS-Identifier = "00:08:da:57:3f:63" NAS-Port = 0 Called-Station-Id = "00-08-DA-57-3F-61:" Calling-Station-Id = "00-1A-4B-61-9C-C8" Framed-MTU = 1400 NAS-Port-Type = Ethernet Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020200060d00 State = 0xbbdf20d6badd2d9285f320de1e094fc7 Message-Authenticator = 0x199602f63d262136de69a50907a837a2 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "joe", looking up r rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP c ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 30 to 1.2.3.126 port 1024 EAP-Message = 0x010303ee0d80000007... Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbbdf20d6b9dc2d9285f320de1e094fc7 Finished request 6. Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 1.2.3.126 port 1024, id=31, length=179 User-Name = "joe" NAS-IP-Address = 1.2.3.126 NAS-Identifier = "00:08:da:57:3f:63" NAS-Port = 0 Called-Station-Id = "00-08-DA-57-3F-61:" Calling-Station-Id = "00-1A-4B-61-9C-C8" Framed-MTU = 1400 NAS-Port-Type = Ethernet Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300060d00 State = 0xbbdf20d6b9dc2d9285f320de1e094fc7 Message-Authenticator = 0xd5780baba7af2999a85f8234b3c06fc5 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "joe", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop rad_check_password: Found Auth-Type etc...

1 0

radcheck question
by Pete Kay 28 May '08

28 May '08

Hi, My freeradius works if I use a test client to send in the username and password, but when I switch to sip server, it does not work anymore. I have searched the internet and some people suggested that this may be due to Attribute setting, so I tried 'Cleartext-Password','User-Password', and 'Digest-HA1', but none of those work. What is wrong with my radius setting? Your help will be greately appreciated. Thanks, Pete Here is the radiusd -X log: Waking up in 4.9 seconds. User-Name = "1006(a)192.168.1.104" Digest-Attributes = 0x0a0631303036 Digest-Attributes = 0x010f3139322e3136382e312e313034 Digest-Attributes = 0x022a3438336465356263616637653 5646335323862373335643661393364363634636237376533396636 Digest-Attributes = 0x04137369703a3139322e3136382e312e313034 Digest-Attributes = 0x030a5245474953544552 Digest-Response = "9b614ed006554a3a7ea094b14237dae9" Service-Type = IAPP-Register X-Ascend-PW-Lifetime = 825241654 NAS-Port = 5060 NAS-IP-Address = 127.0.0.1 +- entering group authorize ++[preprocess] returns ok expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20080529 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/127.0.0.1/auth-detail-20080529 expand: %t -> Thu May 29 07:02:41 2008 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_digest: Adding Auth-Type = DIGEST ++[digest] returns ok rlm_realm: Looking up realm "192.168.1.104" for User-Name = " 1006(a)192.168.1.104" rlm_realm: Found realm "192.168.1.104" rlm_realm: Adding Stripped-User-Name = "1006" rlm_realm: Adding Realm = "192.168.1.104" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop expand: %{Stripped-User-Name} -> 1006 expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> 1006 rlm_sql (sql): sql_set_user escaped user --> '1006' rlm_sql (sql): Reserving sql socket id: 1 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1006' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '1006' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '1006' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = '1006' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '1006' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = '1006' ORDER BY priority expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'openser' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'openser' ORDER BY id rlm_sql (sql): User found in group openser expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'openser' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'openser' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type Local !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [1006(a)192.168.1.104/<via Auth-Type = Local>] (from client localhost port 5060) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> 1006(a)192.168.1.104 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 227 for 1 seconds

2 1

Regarding the installation of Radius
by Anant Mule 28 May '08

28 May '08

I have complied freeradius with ./configure, make & make install. but when i give the command as radiusd -X it gives me the error as radiusd: error while loading shared libraries: libfreeradius-radius-2.0.4.so: cannot open shared object file: No such file or directory I installed freeradius-server-libs-2.0.4-8.1.i586.rpm also. but same errors occure. Please help Thanks in Advance Anant Mule

3 2

2.0.4 occasionally loses User-Password attribute?
by Stefan Winter 28 May '08

28 May '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello list, something weird occcured today. We have one "special" user which is not in a database, but gets a Crypt-Password set hardcoded in the virtual server config. For some reason, the incoming request has a correct User-Password, but later the pap module claims there is none. Here's the -X: Going to the next request Waking up in 4.3 seconds. ~ User-Name = "cyrus" ~ User-Password = "obfuscated" ~ NAS-IP-Address = A.B.C.D ~ NAS-Identifier = "IMAP" ~ NAS-Port = 18585 ~ NAS-Port-Type = Virtual ~ Service-Type = Authenticate-Only server IMAP { +- entering group authorize ++[request] returns notfound ++? if (( User-Name == cyrus ) && ( RESTENA-Service-Type == IMAP ) ) ?? Evaluating (User-Name == cyrus ) -> TRUE ?? Evaluating (RESTENA-Service-Type == IMAP ) -> TRUE ++? if (( User-Name == cyrus ) && ( RESTENA-Service-Type == IMAP ) ) -> TRUE ++- entering if (( User-Name == cyrus ) && ( RESTENA-Service-Type == IMAP ) ) +++[control] returns notfound ++- if (( User-Name == cyrus ) && ( RESTENA-Service-Type == IMAP ) ) returns notfound ~ expand: /var/log/radius/radacct/%Y%m%d/%{RESTENA-Service-Type}-service/auth-detail - -> /var/log/radius/radacct/20080528/IMAP-service/auth-detail rlm_detail: /var/log/radius/radacct/%Y%m%d/%{RESTENA-Service-Type}-service/auth-detail expands to /var/log/radius/radacct/20080528/IMAP-service/auth-detail ~ expand: %t -> Wed May 28 13:18:12 2008 ++[auth_log] returns ok ~ expand: %{User-Name} -> cyrus rlm_sql (sql-imap): sql_set_user escaped user --> 'cyrus' rlm_sql (sql-imap): Reserving sql socket id: 1 ~ expand: (SELECT id, username, attribute, value, op FROM check_imap WHERE username='%{SQL-User-Name}') ~ UNION (SELECT id, username, attribute, value, op FROM check_imap_mailgui WHERE username='%{SQL-User-Name}') -> (SELECT id, username, attribute, value, op FROM check_imap WH ERE username='cyrus') UNION ~ (SELECT id, username, attribute, value, op FROM check_imap_mailgui WHERE username='cyrus') rlm_sql_mysql: query: (SELECT id, username, attribute, value, op FROM check_imap WHERE username='cyrus') ~ UNION (SELECT id, username, attribute, value, op FROM check_imap_mailgui WHERE username='cyrus') rlm_sql (sql-imap): Released sql socket id: 1 rlm_sql (sql-imap): User cyrus not found ++[sql-imap] returns notfound ++? if (RESTENA-Service-Type == UserGUI ) ? Evaluating (RESTENA-Service-Type == UserGUI ) -> FALSE ++? if (RESTENA-Service-Type == UserGUI ) -> FALSE rlm_pap: No clear-text password in the request. Not performing PAP. ++[pap] returns noop auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. That is rather strange. The virtual server config is nothing spectacular, though non-standard, so here it is below: server IMAP { authorize { ~ # remember: UserGUI sends its own RESTENA-Service-Type, honour # it (IMAP comes without) ~ update request { ~ RESTENA-Service-Type = "IMAP" ~ } ~ if ( ( User-Name == cyrus ) && ( RESTENA-Service-Type == IMAP ) ) { ~ update control { ~ Crypt-Password := somecryptstring ~ } ~ } ~ auth_log ~ sql-imap ~ if ( RESTENA-Service-Type == UserGUI ) { ~ sql-dialup ~ } ~ pap } authenticate { ~ Auth-Type PAP{ ~ pap ~ } } The thousands of users in the sql-* databases are authenticated fine, the problem only occurs with this one static user. I'm sort of lost here. Greetings, Stefan Winter -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4-svn0 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org iD8DBQFIPUL5+jm90f8eFWYRAoCNAJ43yoK3MUsTaBGyVjPkgwF0WYJyBgCdFvnO BYXomOsHoqdlKRTnyGoaQyM= =ZctO -----END PGP SIGNATURE-----

3 3

undefined symbol: sql_get_socket
by Giovanni Lovato 28 May '08

28 May '08

I compiled deb packages from 2.0.4 sources. I would use rlm_sqlippool but I get this message: symbol lookup error: /usr/lib/freeradius/rlm_sqlippool-2.0.4.so: undefined symbol: sql_get_socket How can I solve that?

4 7

newbie - authentication error
by pkc_mls 28 May '08

28 May '08

Hi all, I'd like to tetst my radius conf with a basic setting. I'm running freeradius-2.0.4-2 on linux debian. my client.conf contains the following : client localhost { ipaddr = 127.0.0.1 secret = testing123 nastype=other } my users file contains the following : testuser

3 10

newbie - authentication error
by pkc_mls 28 May '08

28 May '08

Hi all, I'd like to tetst my radius conf with a basic setting. I'm running freeradius-2.0.4-2 on linux debian. my client.conf contains the following : client localhost { ipaddr = 127.0.0.1 secret = testing123 nastype=other } I still don't know which kind of parametre I have to set in my /etc/freeradius/users file to allow my radtest to work. all my tests with cleartext-password, user-password, aht-type, and := =, ==, leads to the same error message : rad_recv: Access-Request packet from host 127.0.0.1 port 57756, id=178, length=59 User-Name = "testuser" User-Password = "testpasswd" NAS-IP-Address = x.x.x.x NAS-Port = 1812 Wed May 28 11:41:06 2008 : Debug: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user next step, how to set up the users file so my local unix users can also be authenticated via radius ? thanks

2 2

gigawords how to?
by Oguzhan Kayhan 27 May '08

27 May '08

Hello, i tried to add gigawords for freeradius 2.0 And added the gigawords lines as i seen on web and final version was like this.. accounting_update_query = "UPDATE ${acct_table1} \ SET FramedIPAddress = '%{Framed-IP-Address}', \ AcctSessionTime = '%{Acct-Session-Time}', \ AcctInputOctets = '%{Acct-Input-Octets}', \ AcctInputGigawords = '%{Acct-Input-Gigawords}', \ AcctOutputOctets = '%{Acct-Output-Octets}' \ AcctOutputGigawords='%{Acct-Output-Gigawords}', \ WHERE AcctSessionId = '%{Acct-Session-Id}' \ AND UserName = '%{SQL-User-Name}' \ AND NASIPAddress= '%{NAS-IP-Address}'" But after restarting the freeradius i started to get the following errors. Couldn't update SQL accounting ALIVE record - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'AcctOutputGigawords= '0', WHERE AcctSessionId = '483bfd5200000007' ' at line 1 So what can be the error?

1 1