July 2008 - Freeradius-Users - lists.freeradius.org

Logging NAS IP address and supplicant MAC/IP address with subnet in clients.conf
by lowbassman＠gmail.com 15 Jul '08

15 Jul '08

Hi, I'm running freeradius-1.1.7.1 and have switched to using a subnet for my NAS devices in clients.conf. Unfortunately, my logs no longer tell me which NAS device a request came from and show only the MAC address of the user's laptop. Is there a way to get the NAS IP address as well in the logs? Having the NAS IP, the user's laptop IP and also MAC address in one line would be great. Thanks! ~Matt

2 1

Re :
by Reveal MAP 15 Jul '08

15 Jul '08

Thank you Ivan for the response. yes, i first supplied the entired output of radiusd -X, but the mail was too long and was expected to be moderate. so i cut it. I will try to send a mschap request and see. ------ ntlm_auth is in mschap module and you are sending a pap request. Test with mschap (or real peap user). BTW that's not " the entire output of RADIUSD -X." It's radtest output. Ivan Kalik Kalik Informatika ISP Dana 15/7/2008, "Reveal MAP" <revealmapp(a)yahoo.fr> piše: >Hello list! > >after >i succeed creating my CA, (thanks a lot sergio), i encounter a new >problem with Active Directory integration! i succeded it with help of >this mailing list a couple of week ago, but in FR-2.0.2. > >Now i use FR-2.0.5. >I >followed the HOWTO, so ntlm_auth and winbind authenticate successfully. >i didn't take a look at winbind_priviledge yet, but, when i try to >authenticate with a user of existing in active Directory (using >radtest), it just reject the user without no more message (taht i could >interpretate to find what is missing). > > > >i set in /etc/raddb/module/mschap that lines: >---------------------------------------------------------------------------------------------- >mschap { > use_mppe = yes > #require_encryption = yes > #require_strong = yes > with_ntdomain_hack = yes > >ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key >--username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} >--nt-response=%{mschap:NT-Response:-00}" >} > >but still noticed this line on the ouput too (at radiusd -X startup): >---------------------------------------------------------------------------------------------- >Module: Linked to sub-module rlm_eap_mschapv2 > Module: Instantiating eap-mschapv2 > mschapv2 { > with_ntdomain_hack = no //shouldn't it be yes instead of no here? >------------------------------------------------------------------------------------------------- > > >here is the entire output of RADIUSD -X. thanx for help: >-------------------------------------------------------------------------------------------- >aaa:~ # radtest glouglou glouglou localhost 1812 testing123 >Sending Access-Request of id 74 to 127.0.0.1 port 1812 > User-Name = "glouglou" > User-Password = "glouglou" > NAS-IP-Address = 127.0.0.2 > NAS-Port = 1812 >rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=74, length=20 >-------------------------------------------------------------------------------------------- > > > > _____________________________________________________________________________ >Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoofr > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

1 0

None
by Reveal MAP 15 Jul '08

15 Jul '08

Hello list! after i succeed creating my CA, (thanks a lot sergio), i encounter a new problem with Active Directory integration! i succeded it with help of this mailing list a couple of week ago, but in FR-2.0.2. Now i use FR-2.0.5. I followed the HOWTO, so ntlm_auth and winbind authenticate successfully. i didn't take a look at winbind_priviledge yet, but, when i try to authenticate with a user of existing in active Directory (using radtest), it just reject the user without no more message (taht i could interpretate to find what is missing). i set in /etc/raddb/module/mschap that lines: ---------------------------------------------------------------------------------------------- mschap { use_mppe = yes #require_encryption = yes #require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } but still noticed this line on the ouput too (at radiusd -X startup): ---------------------------------------------------------------------------------------------- Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no //shouldn't it be yes instead of no here? ------------------------------------------------------------------------------------------------- here is the entire output of RADIUSD -X. thanx for help: -------------------------------------------------------------------------------------------- aaa:~ # radtest glouglou glouglou localhost 1812 testing123 Sending Access-Request of id 74 to 127.0.0.1 port 1812 User-Name = "glouglou" User-Password = "glouglou" NAS-IP-Address = 127.0.0.2 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=74, length=20 -------------------------------------------------------------------------------------------- _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

rlm_pap: WARNING! No "known good" password found for the user.
by Maciej Drobniuch 15 Jul '08

15 Jul '08

Hi! >radtest fred somepass localhost 1813 somesecret Sending Access-Request of id 102 to 127.0.0.1 port 1812 User-Name = "fred" User-Password = "somepass" NAS-IP-Address = 127.0.0.1 NAS-Port = 1813 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=102, length=20 rad_verify: Received Access-Reject packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) >radiusd -X rad_recv: Access-Request packet from host 127.0.0.1 port 32770, id=102, length=56 User-Name = "fred" User-Password = "h\347`\005\270\202\336<\336i~e\031\r\021[" NAS-IP-Address = 127.0.0.1 NAS-Port = 1813 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "fred", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> fred attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 102 to 127.0.0.1 port 32770 Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 102 with timestamp +151 Ready to process requests. >cat client.conf client 127.0.0.1 { secret = somesecret shortname = localhost nastype = other } >cat users fred Cleartext-Password =="somepass" Service-Type = Framed-User, Framed-Protocol = PPP wilma Auth-Type := CHAP, User-password =="somepass" Service-Type = Framed-User, Framed-Protocol = PPP barney Auth-Type := MS-CHAP, User-Password == "somepass" Service-Type = Framed-User, Framed-Protocol = PPP What's wrong with this line >User-Password = "h\347`\005\270\202\336<\336i~e\031\r\021[" ??? Thanks for the support! -- ------------------------ Maciej Drobniuch

5 9

freeradius 2.0.5 linking error with rlm_perl on solaris10
by Ubale, Abhishek Amarnath 15 Jul '08

15 Jul '08

Hi, Im trying to install freeradius 2.0.5 on solaris10 (sparc) and Im only interested in rlm_perl module. My configure script is ./configure --prefix=/usr/local/radius --with-static-modules=perl --disable-shared --without-rlm_sql --without-rlm_eap --without-rlm_ldap --without-rlm_krb5 --without-rlm_python --without-rlm_counter --without-rlm_ippool --without-rlm_otp --without-rlm_acctlog --without-rlm_caching --without-rlm_chap --without-rlm_dbm --without-rlm_detail --without-rlm_digest --without-rlm_mschap --without-rlm_unix --without-rlm_smb --without-rlm_realm --without-rlm_radutmp --without-rlm_preprocess --without-rlm_passwd --without-rlm_pap --without-rlm_pam --without-rlm_opendirectory --without-rlm_logintime --without-rlm_linelog --without-rlm_jradius --without-rlm_files --without-rlm_fastusers --without-rlm_detail --without-rlm_cram --without-rlm_copy_packet --without-rlm_checkval --without-rlm_attr_filter --without-rlm_attr_rewrite --without-rlm_always --without-rlm_sqlippool ./gmake is throwing out errors as follows: [...] gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/var/tmp/freeradius-server-2 2.0.5/src -I/var/tmp/freeradius-server-2.0.5/libltdl -I/usr/local/include -I/opt/local/include -D_LARGEFILE_SOURCE -D D_FILE_OFFSET_BITS=64 -I/usr/local/perl-5.8.3/lib/5.8.3/sun4-solaris/CORE -c rlm_perl.c -o rlm_perl.o >/dev/null 2>&1 /var/tmp/freeradius-server-2.0.5/libtool --mode=link gcc -release 2.0.5 \ -module -static -o rlm_perl.la \ -rpath /usr/local/radius/lib rlm_perl.lo rlm_perl.c /var/tmp/freeradius-server-2.0.5/src/lib/libfreeradius-radius.la `perl -MExtUtils::Embed -e ldopts` -lnsl -lresolv -lsocket -lposix4 -lpthread *** Warning: Linking the shared library rlm_perl.la against the *** static library /usr/local/perl-5.8.3/lib/5.8.3/sun4-solaris/auto/DynaLoader/DynaLoader.a is not portable! [...] /usr/local/gnu/bin/nm: DynaLoader.a: File format not recognized /usr/local/gnu/bin/nm: DynaLoader.a: File format not recognized /usr/local/gnu/bin/nm: DynaLoader.a: File format not recognized /usr/local/gnu/bin/nm: DynaLoader.a: File format not recognized ../modules/rlm_perl/.libs/rlm_perl.a(rlm_perl.o): In function `xs_init': rlm_perl.o(.text+0x110): undefined reference to `boot_DynaLoader' rlm_perl.o(.text+0x114): undefined reference to `boot_DynaLoader' collect2: ld returned 1 exit status gmake[4]: *** [radiusd] Error 1 gmake[3]: *** [common] Error 2 gmake[2]: *** [all] Error 2 gmake[1]: *** [common] Error 2 gmake: *** [all] Error 2 Please help me out here. thanks Abhishek

2 2

How to configure radius server
by Sandeep 15 Jul '08

15 Jul '08

Hi, all members of free radius..I install fras fedora9 and want to make radius server but i am new in this field is any body help me to do this. first of all please provide me step to step tutorials so that i can read it and install configure my server .. with testing PLEASE HELP ME Sandeep rohilla

4 3

Compiling client PAM files on Mac OS
by Paul Goodman 15 Jul '08

15 Jul '08

Does anyone have some hacks to enable a clean compile on Mac OS X? When I try to run make, I get the following compile errors: cc -Wall -fPIC -c pam_radius_auth.c -o pam_radius_auth.o pam_radius_auth.c: In function ‘get_random_vector’: pam_radius_auth.c:358: error: storage size of ‘tz’ isn’t known pam_radius_auth.c:363: warning: implicit declaration of function ‘gettimeofday’ pam_radius_auth.c:358: warning: unused variable ‘tz’ pam_radius_auth.c: In function ‘talk_radius’: pam_radius_auth.c:886: warning: pointer targets in passing argument 6 of ‘recvfrom’ differ in signedness pam_radius_auth.c: In function ‘pam_sm_authenticate’: pam_radius_auth.c:1102: warning: assignment from incompatible pointer type make: *** [pam_radius_auth.o] Error 1 Is there something besides the X Code that I need to have installed?

3 4

Re : Re : certificate client.* non valid on windows XP
by Reveal MAP 14 Jul '08

14 Jul '08

Thanx for your help Sergio, but it is exactly the same!! it doesn't work. ----- Message d'origine ---- De : Sergio <sergioyebenes(a)alumnos.upm.es> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Dimanche, 13 Juillet 2008, 18h51mn 41s Objet : Re : certificate client.* non valid on windows XP Reveal MAP escribió: > Installing ca.der, server.crt and client.crt, i obtain exactly the > same result!! > > ----- Message d'origine ---- > De : Sergio <sergioyebenes(a)alumnos.upm.es> > À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Envoyé le : Dimanche, 13 Juillet 2008, 16h59mn 38s > Objet : Re: Re : certificate client.* non valid on windows XP > > Reveal MAP escribió: > > Thank you Sergio for your answer. > > > > > > - windows says too that one of the certificate authority seems to not > > be able to deliver certificate or can't be used as final entity... > > so, I tried what you said: install Server.p12 as intermediate CAr, > > without resolving the problem. > > > > i will try to make my own certs and see. thanks! > > > > ----- > > > > > > > I had the same problem. The fact is that server is an intermediate > > authotity and, using internet explorer, you need to install server.p12 > > into intermediate trusted ca containeer. Also check validity period > > (begining date). I had to change windows date to next day, but I don't > > remember why. Finally I made my own ca because default radius PKI was > > confusing me, and I used mi ca private key to sign client.* > > I hope that this help you. > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > ----- Message d'origine ---- > > De : Sergio <sergioyebenes(a)alumnos.upm.es > <mailto:sergioyebenes@alumnos.upm.es>> > > À : FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org > <mailto:freeradius-users@lists.freeradius.org>> > > Envoyé le : Dimanche, 13 Juillet 2008, 16h09mn 34s > > Objet : Re: certificate client.* non valid on windows XP > > > > Reveal MAP escribió: > > > hi, > > > > > > I use freeradius 2.0.5 and openSUSE 10.3 > > > > > > i ran "bootstrap" script + "make client.pem", "make.client.p12", > > > - I imported "ca.der" on my xp laptop, located at the CA Authorithy > > > containeer. > > > I imported server.p12 too (just to verify the signature) and > > > everything is Ok > > > - But when i import client.p12, windows says me this certificated is > > > not valid! and i dont know why. > > > > > > I executed two commands: server.vrfy and client.vrfy, hoping their > > > output (below) could help. > > > > > > > > > Thank you for helping > > > > > > ------------------------------------------------------------------------------------------------- > > > linux:/etc/raddb/certs # make server.vrfy > > > openssl verify -CAfile ca.pem server.pem > > > server.pem: OK > > > > > > > > > make client.vrfy > > > openssl pkcs12 -export -in server.crt -inkey server.key -out > > > server.p12 -passin pass:`grep output_password server.cnf | sed > > > 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | > > > sed 's/.*=//;s/^ *//'` > > > openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep > > > output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout > > > pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` > > > MAC verified OK > > > openssl pkcs12 -export -in client.crt -inkey client.key -out > > > client.p12 -passin pass:`grep output_password client.cnf | sed > > > 's/.*=//;s/^ *//'` -passout pass:`grep output_password client.cnf | > > > sed 's/.*=//;s/^ *//'` > > > openssl pkcs12 -in client.p12 -out client.pem -passin pass:`grep > > > output_password client.cnf | sed 's/.*=//;s/^ *//'` -passout > > > pass:`grep output_password client.cnf | sed 's/.*=//;s/^ *//'` > > > MAC verified OK > > > cp client.pem `grep emailAddress client.cnf | grep '@' | sed > > > 's/.*=//;s/^ *//'`.pem > > > c_rehash . > > > Doing . > > > 02.pem => eee97f35.0 > > > WARNING: Skipping duplicate certificate user(a)example.com.pem > <mailto:user@example.com.pem> > > <mailto:user@example.com.pem <mailto:user@example.com.pem>> > > > client.pem => 583a9f4b.0 > > > 01.pem => dcd1729a.0 > > > WARNING: Skipping duplicate certificate user2(a)example.com.pem > <mailto:user2@example.com.pem> > > <mailto:user2@example.com.pem <mailto:user2@example.com.pem>> > > > server.pem => dcd1729a.1 > > > WARNING: Skipping duplicate certificate 03.pem > > > WARNING: Skipping duplicate certificate 04.pem > > > ca.pem => 23537b55.0 > > > openssl verify -CApath . client.pem > > > client.pem: OK > > > > > > > ------------------------------------------------------------------------ > > > Envoyé avec Yahoo! Mail > > > > > > <http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/…>. > > > Une boite mail plus intelligente. > > > > > > __________ Informaci�n de NOD32, revisi�n 3263 (20080711) __________ > > > > > > Este mensaje ha sido analizado con NOD32 antivirus system > > > http://www.nod32.com > > > > ------------------------------------------------------------------------ > > > > > > - > > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > > > > __________ Información de NOD32, revisión 3263 (20080711) __________ > > > > > > Este mensaje ha sido analizado con NOD32 antivirus system > > > http://www.nod32.com > > > > > > ------------------------------------------------------------------------ > > Envoyé avec Yahoo! Mail > > > <http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/…>. > > Une boite mail plus intelligente. > > > > __________ Informaci�n de NOD32, revisi�n 3263 (20080711) __________ > > > > Este mensaje ha sido analizado con NOD32 antivirus system > > http://www.nod32.com > > ------------------------------------------------------------------------ > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > __________ Información de NOD32, revisión 3263 (20080711) __________ > > > > Este mensaje ha sido analizado con NOD32 antivirus system > > http://www.nod32.com > > > Try to install server.cer, not server.p12 into intermediate containeer. > open client cert with IE and see certification route. If you can see the > 3 level route but client cert isn't ok, check dates. I'm sure this works. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------------------------------------------------ > Envoyé avec Yahoo! Mail > <http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/…>. > Une boite mail plus intelligente. > > __________ Informaci�n de NOD32, revisi�n 3263 (20080711) __________ > > Este mensaje ha sido analizado con NOD32 antivirus system > http://www.nod32.com > ------------------------------------------------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > __________ Información de NOD32, revisión 3263 (20080711) __________ > > Este mensaje ha sido analizado con NOD32 antivirus system > http://www.nod32.com > If you install client.crt you only have installed client public key. DER format (crt, cer, der) usually contains only public key. p12 format contains public and private key. Because of this, and because server is your signer, you should install ca.der, server.crt and client.p12 into root, intermediate, and personal containeers, respectively and with this order to be sure. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

3Com Siwtch with Freeradius
by Abdullah Dizdar 14 Jul '08

14 Jul '08

Hi, I have 3Com 4500 switch . I have configured freeRadius by using eap authentication and certificate. Could you send me freeradius config and 3com 4500 switch config. who help me best regards,

3 2

Get AD Profile
by Nelson Vale 13 Jul '08

13 Jul '08

Hi all, I have my freeradius deploy (2.0.2) configured to authenticate users against Active Directory and that is working fine. But I want to retrieve user's profile from Active Directory, to add VLAN ID (Tunel-Private-Group-ID) to Access-Accept reply. I really don't know how to do this and I could find a clear solution, either in documentation (rlm_ldap) ot by googling. So I would appreciate if someone could give me a hand on this. What I've done so far is to add this entry to ldap.attrmap file: "replyItem radiusProfileDn memberOf". The profile I want to retrieve is the CN in this object like "cn=PROFILE,dc=domain,dc=com", but in radius debug I'm getting this error: ++[ntdomain] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for figo expand: %{Stripped-User-Name} -> figo expand: (sAMAccountName=%{%{Stripped-User-Name}:-%{%{User-Name}:-none}}) -> (sAMAccountName=figo) expand: dc=ldaptest,dc=pt -> dc=ldaptest,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=ldaptest,dc=com, with filter (sAMAccountName=figo) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Failed to create the pair: Invalid octet string "CN=grupo1,DC=ldaptest,DC=com" for attribute name "radiusProfileDn" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? rlm_ldap: user figo authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_eap: EAP packet type response id 8 length 80 rlm_eap: Continuing tunnel setup. ++[eap] returns ok ++[mschap] returns noop expand: %{Stripped-User-Name} -> figo expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-none}} -> figo ++[files] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Success Using saved attributes from the original Access-Accept rlm_eap: Freeing handler ++[eap] returns ok Login OK: [LDAPTEST.COM\\figo/<via Auth-Type = EAP>] (from client portatil port 0 cli 02-00-00-00-00-01) Sending Access-Accept of id 17 to 192.168.10.200 port 33000 User-Name = "figo" MS-MPPE-Recv-Key = 0x69e42b94d9070d50bf16c6f70d904c94799f99dc1aeb8f2c7485968674c5cad5 MS-MPPE-Send-Key = 0xa67fc2e54c9ec96e583225bb123ed223e55846230bbdb26eeb6bb0b16bd5c57d EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 Is this the way I to achieve or I want or am I completely wrong? Thnx, Nelson Vale

2 2