July 2008 - Freeradius-Users - lists.freeradius.org

Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)
by Reveal MAP 26 Jul '08

26 Jul '08

e: Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls) > http://tinypaste.com/5b99b = Radiusd -X output. [snip] rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. //Normal, i am not willing to do PAP but mschapv2 <me> If you’re not using a module, disable it. All it’ll do is add latency, delays and unnecessary log messages. Comment it out ... lol, i deactivated chap module yet, i let pap cause sometimes i use "radtest" for test! but PAP, SQL module will be deactivated soon and we shall see. maybe monday or tuesday, you will have a clean log! please, stay connected to the post ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for glouglou with NT-Password //does the 3 previous lines means there is an error? what does "No Cleartext-Password configured means? <me> it means, it cannot find a clear text password in the backend data store, which it expects to do .. <Revealmap> pfiouh, previously with another version of freeradius and the same devices and the same config, doing thesame astype of authentication, iwas sure i had these two lines and encounterd no error! but i am not sure.! // what does LM-Password means? and if it's error, how could i correct it? <me> Check your configuration. All depends on so many things .. // ithought it was normal, as I am surewindows never sends "cleartext-Password" Oh, Windows sure has been using clear text passwords, so it then also has a need to be backwards compatible with itself, right? expand: --username=%{mschap:User-Name}-> --username=glouglou //...???... mschap2: d1 expand: --challenge=%{mschap:Challenge:-00} -> --challenge=4a2a69e7929b2c03 //...???... expand: --nt-response=%{mschap:NT-Response:-00}} -> --nt-response=e9ea7e1669ef48501476149962484763f8f98b93fca2ced6} //...???... Exec-Program output: NT_KEY: 067F1C60B6DDB9D2802A458C4EFE22C1 //...???... Exec-Program-Wait: plaintext: NT_KEY: 067F1C60B6DDB9D2802A458C4EFE22C1 //...???... //negociation that is out of the range of my brain till now, but i think ity's normal security negociation in windows system, and there is no error here. Exec-Program: returned: 0 //...???... rlm_mschap: adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success //...???... if MSCHAP Success, where is the matter with this module??? <me> what makes you believe there is a problem at this stage? <Revealmap I was just showing to sergionthat i think mschapv2 module is correct ++[eap] returns handled } # server (null) //...???... PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x011200331a0311002e533d31303435323031393932463633443944424132303644424643343341413242354132313236344636 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x95b92b9094ab31501a0a30daea5106ca PEAP: Processing from tunneled session code 0x81b78d8 11 EAP-Message = 0x011200331a0311002e533d31303435323031393932463633443944424132303644424643343341413242354132313236344636 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x95b92b9094ab31501a0a30daea5106ca PEAP: Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 164 to 10.10.44.246 port 1042 EAP-Message = 0x0112004a1900170301003f9d2524cd5e275d581a614935870e9c19c11e3a4e05332e915ef1f0a46bed9a751bbc330d98db1e52e04119a926415da6ee52cb7e6cc6693a8f1bb8847a7af3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe8ed0301efff1a196c3b0024d8e45892 //...???... and then What? and why its stops..???... <me> why do I get the feeling that if Message-Authenticator is all zeros, it is a “nope, not going to happen mate” type return, effectively stopping any further processing. Why I have no idea .. Alan?? <Revealmap the NAS sends message authenticator, but what happens here? (see below) and um... isn't it cleartext-password received here?? rad_recv: Access-Request packet from host 10.10.44.246 port 1042, id=157, length=168 User-Name = "PLUTON\\glouglou" NAS-IP-Address = 10.10.44.246 NAS-Port = 2 Called-Station-Id = "00-1C-F0-08-FB-FA:PEAP" Calling-Station-Id = "00-12-F0-0C-97-61" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020a001401504c55544f4e5c676c6f75676c6f75 Message-Authenticator = 0x89dbb5baabca7b646ff74e7a0372d4d2 [cut out bits that are not relevant, nor commented, nor anything. Let’s trim messages folks. If it’s not used or relevant, get rid of it.. It only takes space] _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

1 0

Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)
by Reveal MAP 26 Jul '08

26 Jul '08

hmm... it's true i didn't test authentication with another laptop! i will! and i will too with secureW2 instead ofXP built-in wireless manager, and see!! > see the logf there: http://tinypaste.com/5b99b Your problem is nothing to do with certificates. The PEAP tunnel gets setup correctly, the MS-CHAP client->server auth succeeds, but the final server->client (mutual) auth appears to fail. This could be for a number of reasons, but it's a problem at the client side. You will need to debug it at the client side. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

1 0

Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)
by Reveal MAP 26 Jul '08

26 Jul '08

I read the post: "PEAP or TTLS and Microsoft Vista". what i remain is i have to test another wireless mlanager differentthan trhe built-in of windows XP. ok, i will as soon as i will be infront of the server (no chance, it's week-end now) ----- Message d'origine ---- De : nf-vale <nf-vale(a)critical-links.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Vendredi, 25 Juillet 2008, 20h51mn 58s Objet : Re : Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls) Are you using vista supplicant? By reading the last lines of your radius debug file it seems so... See earlier posts with subject: "PEAP or TTLS and Microsoft Vista". Sex, 2008-07-25 às 17:10 +0000, Reveal MAP escreveu: > > > > installing ca.der and putting user && pass into client machine, the > authentication doesn't work? > > -- no, it doesn't! > > > you only need ca.der but, if you have an active directory like > LDAP, > check if your comunication with AD server also have tls > authentication. > Into ldap module you can configurate another tls block, which it's > different than tls block into eap module. > > -- Well, the howto espalaining how freeradius has to authenticate > users against Active Directory says nothing about ldap config files on > linux server. it just gives tips about samba, using winbind, > ntlm_auth, krb5.conf, nsswitch.conf and mschap module in freeradius. > I ever success this kind of authentication without reading or changing > a line of ldap module in freeradius. > and i think, authenticating users against Openldap won't be managed > like authentication of freeradius using active directory. > > >I don't know if it is your problem, but I suppose that comunication > between ldap server and radius can have different certificates, from > different ca's than eap comunication. > > > my wireless network is secured with wpa/wpa2 entreprise, requiring a > RADIUS server to perform authentication. so i am doing 802.1x > authentication which exploit a valid PKI,regardless of the base of > users. this is how i understand it. > > > If it is your problem, I would > check it. also would be good you post de debug of radius to see which > certificate can't validate. > > see the logf there: http://tinypaste.com/5b99b > active and valid user is: > login: glouglou > password: glouglou > > aaa:~ # ntlm_auth --username=glouglou --request-nt-key --domain=PLUTON > password: > NT_STATUS_OK: Success (0x0) > aaa:~ # > > > :/ Any help will be appreciated. these days i am wondering about > validity of the Server certificate! > I have to tell you that, in my case, if i try a peap authentication > against Active Directoiry with wrong users credentials, i have an > error message saying that login or password is incorrect. with good > users credential, i just obtain what you can see in the Radiusd -X > output (http://tinypaste.com/5b99b) > > thank you > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > ______________________________________________________________________ > Envoyé avec Yahoo! Mail. > Une boite mail plus intelligente. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

1 0

Re : Re : Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)
by Reveal MAP 26 Jul '08

26 Jul '08

> installing ca.der and putting user && pass into client machine, the authentication doesn't work? -- no, it doesn't! > you only need ca.der but, if you have an active directory like LDAP, check if your comunication with AD server also have tls authentication. Into ldap module you can configurate another tls block, which it's different than tls block into eap module. -- Well, the howto espalaining how freeradius has to authenticate users against Active Directory says nothing about ldap config files on linux server. it just gives tips about samba, using winbind, ntlm_auth, krb5.conf, nsswitch.conf and mschap module in freeradius. I ever success this kind of authentication without reading or changing a line of ldap module in freeradius. and i think, authenticating users against Openldap won't be managed like authentication of freeradius using active directory. >I don't know if it is your problem, but I suppose that comunication between ldap server and radius can have different certificates, from different ca's than eap comunication. my wireless network is secured with wpa/wpa2 entreprise, requiring a RADIUS server to perform authentication. so i am doing 802.1x authentication which exploit a valid PKI,regardless of the base of users. this is how i understand it. > If it is your problem, I would check it. also would be good you post de debug of radius to see which certificate can't validate. see the logf there: http://tinypaste.com/5b99b active and valid user is: login: glouglou password: glouglou aaa:~ # ntlm_auth --username=glouglou --request-nt-key --domain=PLUTON password: NT_STATUS_OK: Success (0x0) aaa:~ # :/ Any help will be appreciated. these days i am wondering about validity of the Server certificate! I have to tell you that, in my case, if i try a peap authentication against Active Directoiry with wrong users credentials, i have an error message saying that login or password is incorrect. with good users credential, i just obtain what you can see in the Radiusd -X output (http://tinypaste.com/5b99b) thank you - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

4 4

Re : Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)
by Reveal MAP 25 Jul '08

25 Jul '08

> But I think this problem do not affect peap because peap do not use > client certs, you only need to install ca.der into client machine and > put the passwords i refer to that: > so my question is, if the certificate (with server extension) is missing on the client, could it interfer in EAP-PEAP authentication success? yes. you need a RADIUS cert with the extensions...and if doing proper PEAP, you need the CA installed on the client too - with 'validate server certificate' checked and cross-linked (ie you choose the correct CA in the list!) alan really?? it seems to affect PEAP too when freeradius authenticates against Active Directory. if i understood well,PEAP authentication need client side a login + password and server side a certificate in order to the authentication process to success! so, which certificate have i to install on client side? - i did ever try ca.der with no success! 'after an access-challenge, the request simply stops. - i am trying sever.crt too, with no more success. i install it in intermediate authority containeer,but it won't be available in the list of the wireless manager of xp. if you have a suggestion, i am open! ----- Message d'origine ---- De : Sergio <sergioyebenes(a)alumnos.upm.es> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Vendredi, 25 Juillet 2008, 13h20mn 54s Objet : Re: Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls) Reveal MAP escribió: > HOW TO FIX THE PROBLEM OF THE ISSUER of clients certificates in > default configuration? > > - this bug is suspected to make i can't do EAP-PEAP and affect the CRL > management too. it's a real problem > > > > ----- Message d'origine ---- > De : Alan DeKok <aland(a)deployingradius.com> > À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Envoyé le : Jeudi, 24 Juillet 2008, 19h54mn 32s > Objet : Re: cert bootstrap bug? (was Re: definitively, I have a > problem with eap-tls) > > Sergio wrote: > > But the debug I posted shows that radius doesn't recognize the issuer of > > client cert using default certs. If default certs works and I don't need > > to install server.pem and ca.pem into ssl/certs dir, what I'm forgetting > > alan? > > You need to follow the documentation in eap.conf. > > # If CA_file (below) is not used, then the > # certificate_file below MUST include not > # only the server certificate, but ALSO all > # of the CA certificates used to sign the > # server certificate. > certificate_file = ${certdir}/server.pem > > Have you done that? > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------------------------------------------------ > Envoyé avec Yahoo! Mail > <http://us.rd.yahoo.com/mailuk/taglines/isp/control/*http://us.rd.yahoo.com/…>. > Une boite mail plus intelligente. > But I think this problem do not affect peap because peap do not use client certs, you only need to install ca.der into client machine and put the passwords - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

Re : cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls)
by Reveal MAP 25 Jul '08

25 Jul '08

HOW TO FIX THE PROBLEM OF THE ISSUER of clients certificates in default configuration? - this bug is suspected to make i can't do EAP-PEAP and affect the CRL management too. it's a real problem ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Jeudi, 24 Juillet 2008, 19h54mn 32s Objet : Re: cert bootstrap bug? (was Re: definitively, I have a problem with eap-tls) Sergio wrote: > But the debug I posted shows that radius doesn't recognize the issuer of > client cert using default certs. If default certs works and I don't need > to install server.pem and ca.pem into ssl/certs dir, what I'm forgetting > alan? You need to follow the documentation in eap.conf. # If CA_file (below) is not used, then the # certificate_file below MUST include not # only the server certificate, but ALSO all # of the CA certificates used to sign the # server certificate. certificate_file = ${certdir}/server.pem Have you done that? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

definitively, I have a problem with eap-tls
by Sergio 25 Jul '08

25 Jul '08

HI, continuing with Reveal MAP problem with unknown ca's under eap-tls using default configuration.... private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem freeradius tell me this: rlm_eap_tls: <<< TLS 1.0 Handshake [length 0bdb], Certificate --> verify error:num=24:invalid CA certificate rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA well, it isn't a problem: cp server.pem root.pem cat ca.pem >> root.pem then I change CA_file = ${cadir}/root.pem ......and.....eureka!!!! authentication succesfully ....but now there is a problem to check the CRL because root.pem then, something is wrong before making root.pem. ....well, just tell freeradius how to find certificates.... c_rehash /usr/local/etc/raddb/certs also doesn't works I think Reveal had the same problem and I have read about this on mailing list but nothing. Also I've tried to install ca.pem on /etc/ssl/certs using "ln -s". Has somebody encountered problems with this apart from Reveal MAP and me? P.D. route certification into windows isn't a problem, only tell xp_supplicant who is root authority (It was logical)

3 14

New SNMP Code
by Alan DeKok 25 Jul '08

25 Jul '08

Sky Network Services has contributed a preliminary implementation of SNMP in the server. It's a Perl script that communicated with net-snmpd via the AgentX protocol. and with FreeRADIUS via the new Status-Server statistics functionality. The result is that you can now obtain FreeRADIUS statistics via SNMP. The code is alpha, but has been tested to work. Please test, and submit patches, suggestions, fixes, etc. back to the list, or to bugs.freeradius.org. See http://git.freeradius.org for the latest source. The new SNMP is in scripts/snmp-proxy/ Alan DeKok.

4 18

PEAP or TTLS and Microsoft Vista.
by Lech Karol Pawłaszek 24 Jul '08

24 Jul '08

Hello. I need your help. For the last few days I try to authenticate and authorize Microsoft Vista operating system against FreeRADIUS and 3com switch (as NAS) for wired authentication with no luck. I'm using FreeRADIUS 2.0.5 from sources built on Debian Etch GNU/Linux and certs made by bootstrap command (so those certs should have a bit of magic from xpextensions afaik). I try to make little steps and change as less as possible - to be honest I've only added user to the users file and client definition to the clients.conf file. I've tested my configuration with eapol_test command (as suggested at this site[1]) and it works fine. I've tested it against MacOsX 10.4 and MacOsX 10.5 and it works fine. I even tested it against Windows XP SP2 and it works fine. It doesn't work with Windows Vista and Windows XP SP3. Please help! What I have spotted is that the server sends "Access Challenge" and then on OSX dialog pops up where I can accept server's certificate and on Windows it's over. So I think it's the issue mentioned on this site[2] however i DO have Validate Server Certificate un-checked. One more thing. If I won't use Windows' PEAP authorization and install securew2 and use securew2's auth - I am able to connect. Work for a minute or so and then NAS reports lost carrier and the connection is lost. I've written about this issue about a year ago however this was put on-hold. You might want to look at logfiles from that tests. [1] - http://deployingradius.com/scripts/eapol_test/ [2] - http://deployingradius.com/documents/configuration/eap-problems.html [3] - http://lists.freeradius.org/pipermail/freeradius-users/2007-July/msg00096.h… Any hints and tips much appreciated. I'm attaching two logfiles. The first one - freeradius.log - is the one where I'm trying to authenticate using system-wide PEAP. The second one, namely freeradius-securew2.log, is the one where switch receives Access-Accept and a few moments later switch sends back information that the carrier is lost. I've compressed both logfiles. I hope it's ok here. If it's not - please let me know. Thanks in advance. -- Lech Karol Pawłaszek <ike> "You will never see me fall from grace." [KoRn]

7 17

Token Authorization
by krzychk2 23 Jul '08

23 Jul '08

Hi, I'm a new user in freeRADIUS. I'd like to do a solution like token authentication. Firts step. User is authorized by user/password. Secound step: For the authentication from LDAP is taken further informations (like UID, date of birth) and user is asked about it. I think it is something familiar with CHAP Challenge but I don't know how to combine this solutions. Could somebody help me?? Greetings Krzysztof Kardas

4 5