June 2008 - Freeradius-Users - lists.freeradius.org

proxy problems with 2.0.5
by Pshem Kowalczyk 10 Jun '08

10 Jun '08

Hi, I upgraded our test server from 2.0.4 to 2.0.5 today and proxy setup we use stopped working. Currently (2.0.4) we have following entries in the users.conf: DEFAULT User-Name =~ '@bitstream.dsl.xxxx$', Proxy-To-Realm := quik-dsl Cisco-AVpair += "ip:dns-servers=x.y.129.67 x.y.129.68", Framed-Pool += "ubs-1", Huawei-Primary-DNS += "x.y.129.67", Huawei-Secondary-DNS += "x.y.129.68" And as expected after the home server said 'accept' I could see the following reply: Framed-Protocol = PPP Service-Type = Framed-User Framed-Pool = "ubs-1" Huawei-Primary-DNS = x.y.129.67 Huawei-Secondary-DNS = x.y.129.68 (a combination of reply from the home server and proxy, plus some filtering). On the 2.0.5 - i only get the attributes from the home servers, stuff doesn't get appended by proxies. Should that continue to work? kind regards Pshem

2 5

PAM, ms-chap and shadow passwords
by up＠3.am 09 Jun '08

09 Jun '08

I understand that radius authenticating ppp (PPTP in this case) connections against shadow passwords requires cleartext authentication (PAP). Does PAM allow you to work around this? From reading what I can find on PAM, it would seem that FreeRADIUS would pass off the authentication request to PAM and PAM could then take care of the crypt/decrypt, thus allowing CHAP or MSCHAP client authentication against shadow passwords. Is this correct? TIA, James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

2 1

Authorization queries based on realm
by sub 09 Jun '08

09 Jun '08

Hi guys, I looked around a bit but I've not found an answer to my question. I have a freeradius server, it works fine and so on but now I need to differentiate class of users that is that I have users of class A that have a Max-All-Session attribute which I manipulate with standard accounting informations and queries (and with the noresetcounter). Class B users, instead, should have access guaranteed only if they have valid access credentials (i.e. username and password) and they should not have a check of Max-All-Session attribute so they have to use resources without any time limit. I thought to use realms but I don't know if it's the right manner to configure this need as I am only able to configure a different radius server according to realm value. Any suggestion please? Thanks, sub

2 1

Fw: need help on accounting respond
by Do Nguyen Ha 09 Jun '08

09 Jun '08

hi all i need help on account of freeradius Accounting Respond Message: AttributeID Vendor ID Sub Attribute ID Status Attribute Name Type Value 26 9 101 O h323-credit-amount String Customer balance at the time of authentication 26 9 103 M+ h323-return-code Integer 5 26 9 109 O h323-billing-model Integer Type of billing service for a specific call: 0 = credit customer (post-paid) 1= debit card (prepaid) 2= limited service (prepaid) 3= limited service (postpaid) 26 9 110 O h323-currency String Customer currency in the form of 3-character value from ISO 4217 (e.g. USD) now i want freeradius reply to the client with Accounting Respond with the structure of message above the M+ : is required where do i edit to make it works Thanks Ha`

2 1

PEAP version 1
by Riccardo Veraldi 09 Jun '08

09 Jun '08

Hello, new network manager version prompt for PEAP version 0 or version 1. Is there support for PEAP version 1 on freeradius ? thanks Riccardo

2 1

Version 2.0.5 has been released
by Alan DeKok 09 Jun '08

09 Jun '08

We are pleased to announce the release of version 2.0.5 of the FreeRADIUS server. Download: http://freeradius.org/download.html FreeRADIUS 2.0.5 ; Date: 2008/05/30 09:31:23 , urgency=medium Feature improvements * Permit SQL authorize_reply_query to be empty. * Allow setting response packet type in Post-Proxy-Type Fail handler. * Added install-chown target to set correct permission and ownership, via make RADMIN=radmin RGROUP=radius install-chown * Support for LDAP-Group and other dynamic comparison attributes in unlang. Developed from a patch by Jason Alderfer. * Added chroot support. See radiusd.conf for comments. * Allow clients of 0/0. We do not recommend using this, though. * Moved many module configurations into raddb/modules/* Bug fixes * Allow proxying to virtual servers for accounting packets, too. * Added "num fields" function to PostgreSQL client. * Updated proxy fallback mechanism to validate fallback servers, and to process fallback requests in a child thread. * rlm_realm returns "ok" for LOCAL realms, not "noop". * Fixed some DHCP code handling. The examples should now work.

3 3

Re: Freeradius-Users Digest, Vol 38, Issue 32
by Piero Giobbi 09 Jun '08

09 Jun '08

Hi Alan. Hers's my version: OpenSSL> version OpenSSL 0.9.8g 19 Oct 2007 OpenSSL> p 7 jun 2008 kl. 12.00 skrev freeradius-users- request(a)lists.freeradius.org: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > Today's Topics: > > 1. Re: Problems compiling Freeradius 2.0.4 on Fedora 8. > (A.L.M.Buxey(a)lboro.ac.uk) > 2. Re: logging of tls logons (Vladimir Vassiliev) > > Från: A.L.M.Buxey(a)lboro.ac.uk > Datum: lö 7 jun 2008 09.40.22 GMT+02:00 > Till: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org > > > Ämne: Re: Problems compiling Freeradius 2.0.4 on Fedora 8. > Svara till: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org > > > > > hi, > > what version of OpenSSL do you have? > > alan > > > > > Från: Vladimir Vassiliev <vova(a)edu.yar.ru> > Datum: lö 7 jun 2008 09.54.16 GMT+02:00 > Till: freeradius-users(a)lists.freeradius.org > Ämne: Re: logging of tls logons > Svara till: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org > > > > >> So, how can I get in logs exactly common names? > > As I understand, only way to do it is > > check_cert_cn = %{User-Name} > > in eap.conf? > > -- > Vladimir Vassiliev <vova(a)edu.yar.ru> > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

PEAP problem when using domain suffix
by Graham Marsh 08 Jun '08

08 Jun '08

Hi Have set up freeradius on a SLES10SP1 box in order to do 802.1X authentication. All is fine if the client submits a request using just the user name e.g. test05 in the case below: Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: Told to do MS-CHAPv2 for test05 with NT-Password rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 6 modcall: leaving group MS-CHAP (returns ok) for request 6 MSCHAP Success modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 However, if the user submits a request with the domain name appended such as @xyz.edu.hk, then the request fails at the same point in the process as shown: Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: Told to do MS-CHAPv2 for test08(a)xyz.edu.hk with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: leaving group authenticate (returns reject) for request 6 auth: Failed to validate the user. Found Post-Auth-Type Processing the post-auth section of radiusd.conf modcall: entering group REJECT for request 6 I defined the domain suffix in the proxy conf file and set it to LOCAL because the local server should process the requests no matter whether the suffix is there or not. I also tried rewriting the User-Name attribute to remove the suffix (which is already done by Stripped-User-Name) but that caused another problem. So I'm at the point where just scratching my head...any hints most appreciated. Graham Marsh Hong Kong

4 9

EAP TLS Authentication failing!!!! "Unknown CA"
by Avinash Patil 07 Jun '08

07 Jun '08

Hi All, I am trying to use authenticate one embedded WLAN device with using freeRadius server 2.0.4 I have radiusd.conf,client.conf files as per my configuration. I have created certificates using bootstrap script.Values in ca.cnf,client.cnf and server.cnf have been modified accordingly. I have copied ca.pem, client.pem to device filesystem.Private key has been extracted from client.pem. Since last week I am trying to authenticate freeradius server but I am getting error like "Unknown CA". Please see attached radius logs. When I verify client certificate using "openssl verify -CApath ca.pem client.pem" I see following error: Error 20 at depth 0 lookup : unable to get local issuer certificate. Device is already tested with Windows 2003 server's TLS(of course with different set of certificates :<) ) and it is working fine. What will be possible reason behind this and where am I going wrong? Appreciate your help. Thanks and Regards, Avinash.

2 1

logging of tls logons
by Vladimir Vassiliev 07 Jun '08

07 Jun '08

I have such entries in my radius.log Fri Jun 6 18:52:31 2008 : Auth: Login OK: [asus_large] (from client wifi port 2 cli 00-19-7D-4A-B7-F4) asus_large - in this example is a common name of SSL certificate and I thought it cannot be forged and I can identify which certificate was used. But today I entered to wifi network from my PDA and saw that I can forge this entry as I want. So, it's not really common name, but something provided by client. So, how can I get in logs exactly common names? -- Vladimir Vassiliev <vova(a)edu.yar.ru>

1 1