July 2008 - Freeradius-Users - lists.freeradius.org

peap-tls support in freeradius
by Gopinath Reddy N 30 Jul '08

30 Jul '08

Hi, I would like to know whether peap-tls(peap as outer authentication, tls as inner authentication method) is supported in freeradius. Some of my clients use peap-tls so want to know whether its supported by freeradius. I tried using a setup that works for tls for peap-tls but it fails saying "rlm_eap_peap: Tunneled data is invalid. " Thanks in advance for ur help. Regards Gopi

2 4

Openser+radiusclient-ng+Freeradius+IAS
by António Rio Costa 30 Jul '08

30 Jul '08

Hi all, I'm trying to put toghether one way to register softphones into openser doing the users authentication in IAS. I would like to put some questions into the list in way to clear out my doubts. 1 Can radiusclient-ng authenticate in IAS ???? If so how? I've tried it and IAS says that there is an malformed radius message. 2 Putting freeradius in the midlle of the radiusclient-ng and IAS shoud he act as a proxy between the radiusclient-ng and the IAS? this configuration works? has anyone done it? Thanks in advance for all the help that anyone can give

2 1

Ldap-Group unlang FR 2.0.5
by Rohaizam Abu Bakar 30 Jul '08

30 Jul '08

OS: FB 7.0 FR: 2.0.5 Let we analyze below if statement using unlang with Ldap-Group:- ++? if (("%{NAS-Port-Type}" =~ /^ISDN|^Sync/) && ((ldap1-Ldap-Group == "UNLIMITED") || (ldap2-Ldap-Group == "UNLIMITED"))) expand: %{NAS-Port-Type} -> ?? Evaluating ("%{NAS-Port-Type}" =~ /^ISDN|^Sync/) -> FALSE ??? Skipping (ldap1-Ldap-Group == "UNLIMITED") ??? Skipping (ldap2-Ldap-Group == "UNLIMITED") ++? if (("%{NAS-Port-Type}" =~ /^ISDN|^Sync/) && ((ldap1-Ldap-Group == "UNLIMITED") || (ldap2-Ldap-Group == "UNLIMITED"))) -> TRUE ++- entering if (("%{NAS-Port-Type}" =~ /^ISDN|^Sync/) && ((ldap1-Ldap-Group == "UNLIMITED") || (ldap2-Ldap-Group == "UNLIMITED"))) suppose if ("%{NAS-Port-Type}" =~ /^ISDN|^Sync/) -> FALSE, the whole line should FALSE. but why it show TRUE? It is AND (&&) comparison. Or possible problem in my if statement?? --haizam

1 0

Digest Authentications Cisco Access Registrar 4.1.X
by Hoa But 29 Jul '08

29 Jul '08

Hello, Thanks for all the RADIUS messages. They are very helpful. I am able to successfully implemented digest authentications in FreeRADIUS and have been using it ever since. This is after getting help from the great people on this mailing. I wonder if anyone here has any experience Cisco Access Registrar 4.1.X as it relates to digest authentications? I know it is probably not related to FreeRADIUS but I tried everything and Cisco Access Registrar 4.1.X keeps dropping the Access-Request packets with response-type: -1. cisco support is of no help. I went through 5 support representatives so far. Below is the output of the trace file (i.e. name_radius_1_trace). This is running on Solaris 10 on a T1000 Ultrasparc T1 8 cores, 4 threads per core, 32 virtual cpus total. I am not sure if any of the cores make any difference. As always, your assistances are greatly appreciated. Best regards, Hoa ------------------ Output of trace file -------------------------- 07/29/2008 18:55:04: P11864: Packet received from 10.8.140.21 07/29/2008 18:55:04: P11864: Packet successfully added 07/29/2008 18:55:04: P11864: Trace of Access-Request packet 07/29/2008 18:55:04: P11864: identifier = 209 07/29/2008 18:55:04: P11864: length = 218 07/29/2008 18:55:04: P11864: reqauth = cf:04:c9:51:ae:f5:ed:34:aa:47:61:ed:9f:96:63:eb 07/29/2008 18:55:04: P11864: User-Name = fakeuser 07/29/2008 18:55:04: P11864: Service-Type = 200 07/29/2008 18:55:04: P11864: NAS-Identifier = qcs-qchat-ops-2-3.qln.test.com.(none) 07/29/2008 18:55:04: P11864: NAS-Port-Type = Virtual 07/29/2008 18:55:04: P11864: Digest-Response = fakeqcdigest 07/29/2008 18:55:04: P11864: Digest-Attributes = { Realm = fakedomain } 07/29/2008 18:55:04: P11864: Digest-Attributes = { Nonce = fakeqcnonce } 07/29/2008 18:55:04: P11864: Digest-Attributes = { Method = QCHAT-REGISTER } 07/29/2008 18:55:04: P11864: Digest-Attributes = { URI = fakedomain } 07/29/2008 18:55:04: P11864: Digest-Attributes = { QOP = auth } 07/29/2008 18:55:04: P11864: Digest-Attributes = { Algorithm = MD5-sess } 07/29/2008 18:55:04: P11864: Digest-Attributes = { CNonce = fakeqccnonce } 07/29/2008 18:55:04: P11864: Digest-Attributes = { Nonce-Count = 1 } 07/29/2008 18:55:04: P11864: Digest-Attributes = { User-Name = fakeuseraddr } 07/29/2008 18:55:04: P11864: Running Server's IncomingScript: show-contents 07/29/2008 18:55:04: Log: Request from 10.8.140.21: Server IncomingScript failed fakeuser 07/29/2008 18:55:04: P11864: Dropping request (response-type: -1) 07/29/2008 18:55:04: P11864: Packet successfully removed ---------------------------------------------------------------------

1 0

Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow
by Ryan Pugatch 29 Jul '08

29 Jul '08

Hello everyone, I am having an issue where when a user attempts to authenticate the following error is logged: Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow FreeRADIUS receives appropriate information as to whether or not the credentials used were correct, but it also throws that error which I suspect is an easy fix. Unforunately, I'm not sure why it can't set that option correctly. Thanks, Ryan

1 0

radrelay freeradius 2.x
by Raffael Himmelreich 29 Jul '08

29 Jul '08

Hi there, I wonder if there's an easy way/guide to reproduce the freeradius 1.x radrelay behavior? I'm afraid that the copy-to-home-server solution does not execute the accounting requests, but only relays them. Am I right? I want to execute accounting requests and relay these packets to another RADIUS server for testing purposes. best regards

3 2

Invalid EAP Type with Catalyst 2960G IOS 12.2
by nf-vale 29 Jul '08

29 Jul '08

Hi all, I'm having a little trouble configuring a Cisco Switch - Catalyst 2960G IOS 12.2 to work properly with EAP-PEAP clients. I've tested the same radius configuration (freeradius 2.0.2) with an HP Procurve 2626 Swicth and all worked just fine. Windows XP clients can authenticate with PEAP successfully. The same clients connected to the Cisco Swicth that it's authenticating in the same freeradius server can not authenticate because freeradius is trying EAP-TLS instead of EAP-PEAP: Ready to process requests. rad_recv: Access-Request packet from host 192.168.2.1 port 1645, id=1, length=129 User-Name = "al00005" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-1E-BD-62-B9-81" Calling-Station-Id = "00-1B-38-92-39-A0" EAP-Message = 0x0206000c01616c3030303035 Message-Authenticator = 0xb8fb13899c9df58f7770efaeeeb9eb1a NAS-Port-Type = Ethernet NAS-Port = 50001 NAS-IP-Address = 192.168.2.1 +- entering group authorize ++[preprocess] returns ok rlm_realm: No '@' in User-Name = "al00005", skipping NULL due to config. ++[suffix] returns noop rlm_realm: No '\' in User-Name = "al00005", skipping NULL due to config. ++[ntdomain] returns noop rlm_eap: EAP packet type response id 6 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[mschap] returns noop expand: %{Stripped-User-Name} -> expand: %{User-Name} -> al00005 expand: %{%{User-Name}:-none} -> al00005 expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-none}} -> al00005 rlm_sql (sql): sql_set_user escaped user --> 'al00005' rlm_sql (sql): Reserving sql socket id: 0 expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'al00005' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 rlm_sql (sql): User found in radcheck table expand: SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'al00005' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='al00005' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 expand: SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id -> SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = 'Alunos' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 rlm_sql (sql): User found in group Alunos expand: SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id -> SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = 'Alunos' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[files] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.2.1 port 1645 Tunnel-Private-Group-Id:0 := "2" EAP-Message = 0x010700061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x12f8640712ff7d8ac69a15b3712e899e Finished request 3. Going to the next request Waking up in 0.9 seconds. Waking up in 4.0 seconds. Cleaning up request 3 ID 1 with timestamp +501 Ready to process requests. Does anybody have a clue on how to solve this problem? Is it a IOS (version 12.2) problem? Thx, Nelson Vale

3 5

Seek through several RADIUS severs without realms
by Ronen Kfir 29 Jul '08

29 Jul '08

My scenario is as follow: I use more then one strong authentication system, which is OTP (One Time Password) based and has a RADIUS interface. I use the same users repository for the various authentication systems and wish to differ between the authentication systems, using Free RADIUS .Net. I wouldn't like to use realms, as I would like users to use ordinary username and not make them use a realm. I think that the way to do it, is to create sort of loop, which will run through the various RADIUS interfaces of the OTP systems and seek for a given username. If it fails on one system, continue to the next one, and if not found in any of them, send reject access response. Best, Ronen.

1 0

freeradius crashing issue - malloc failures?
by Ryan Pugatch 28 Jul '08

28 Jul '08

Hi everyone, I seem to be having a problem with FreeRADIUS crashing. This time, it crashed on Saturday. I noticed it was down this morning and was able to bring it back up. This time difference allowed me to go through the log and see what happened when it crashed on Saturday. Here's the snippet from the log.. I'd appreciate any assistance in debugging this issue. Sat Jul 26 09:13:15 2008 : Error: TLS_accept:error in SSLv3 read client hello C Sat Jul 26 09:13:15 2008 : Error: rlm_eap: SSL error error:140A1041:SSL routines:SSL_BYTES_TO_CIPHER_LIST:malloc failure Sat Jul 26 09:13:15 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Sat Jul 26 09:13:15 2008 : Auth: Login incorrect: [pcoyle] (from client aruba port 2 cli 0019E3D52103) Sat Jul 26 09:14:20 2008 : Auth: Login incorrect: [pcoyle] (from client aruba port 2 cli 0019E3D52103) Sat Jul 26 09:16:55 2008 : Auth: Login incorrect: [pcoyle] (from client aruba port 2 cli 0019E3D52103) Sat Jul 26 09:19:30 2008 : Auth: Login incorrect: [pcoyle] (from client aruba port 2 cli 0019E3D52103) Sat Jul 26 09:20:05 2008 : Error: TLS_accept:error in SSLv3 read client hello C Sat Jul 26 09:20:05 2008 : Error: rlm_eap: SSL error error:140A1041:SSL routines:SSL_BYTES_TO_CIPHER_LIST:malloc failure Sat Jul 26 09:20:05 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Sat Jul 26 09:20:05 2008 : Auth: Login incorrect: [pcoyle] (from client aruba port 2 cli 0019E3D52103) Sat Jul 26 09:22:10 2008 : Error: rlm_eap: SSL error error:1409C041:SSL routines:SSL3_SETUP_BUFFERS:malloc failure Sat Jul 26 09:22:10 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Sat Jul 26 09:22:10 2008 : Auth: Login incorrect: [pcoyle] (from client aruba port 2 cli 0019E3D52103) Sat Jul 26 09:22:45 2008 : Error: rlm_eap: SSL error error:1409C041:SSL routines:SSL3_SETUP_BUFFERS:malloc failure Sat Jul 26 09:22:45 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Sat Jul 26 09:22:45 2008 : Auth: Login incorrect: [pcoyle] (from client aruba port 2 cli 0019E3D52103) Sat Jul 26 09:23:50 2008 : Auth: Login incorrect: [pcoyle] (from client aruba port 2 cli 0019E3D52103) Sat Jul 26 09:24:25 2008 : Error: rlm_eap: SSL error error:1409C041:SSL routines:SSL3_SETUP_BUFFERS:malloc failure Sat Jul 26 09:24:25 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Sat Jul 26 09:24:25 2008 : Auth: Login incorrect: [pcoyle] (from client aruba port 2 cli 0019E3D52103) Sat Jul 26 09:26:36 2008 : Error: Discarding duplicate request from client aruba:32794 - ID: 243 due to unfinished request 991655 Thanks, Ryan

3 5

realm question
by Jeff Crowe 28 Jul '08

28 Jul '08

Hi there, I have a question about prefix realms and stripping them. I have a provider that allows roaming dialup for our customers. They require the username to be in a format of idm/something/username. I get the whole idm/something/username delivered to me as the authentication. I have tried using the IPASS prefix to remove the idm/something, but it just returns the realm of idm and I am still left with stripped-user-name of something/username, I have also tried just adding a realm of "idm/something" to the proxy.conf and it didn't work. I am currently running freeradius 2.0.5 with a SQL (mysql) back end. Can I strip the "idm/something/" somehow? Thanks, Jeff.

2 2